Eight stages from intake to delivery.
Intake
You describe the problem, volume, modality, and compliance deadline. We reply with tier and range. An NDA is in place before any data discussion.
Scope
A signed engagement scope pins the schema, taxonomy, acceptance criteria, and the exact instrument versions used. A GDPR Article 28 DPA is executed with it.
Transfer
Raw data arrives by object store, SFTP, or encrypted media. Receipt is acknowledged with a SHA-256 manifest; the processing window starts.
Validation
Six tiers — structural checks, subject gate, data quality, perceptual quality, categorical assessment, consistency. Failures are recorded in the refusal log.
Build
The dataset is constructed against the scoped schema in Lance-native format with fragment-level versioning. Every run is tracked with an audited lifecycle.
Provenance & signing
Four layers — SHA-256, Merkle, C2PA, SLSA — then an OMS signature: Sigstore keyless or Static Signal PKI, with rotation and revocation.
Evidence assembly
The EU AI Act evidence pack (Articles 9–15) is composed with coverage classification: fully populated, requires human input, or not applicable.
Delivery & deletion
You receive the five artefacts. Acceptance requires running one verification recipe successfully. Raw inputs are deleted within 30 days of acceptance.
Verification
Every deliverable includes verification recipes. Run them against your copy of the dataset:
The exact commands ship inside the deliverable. Each command is tested against that deliverable before release, and acceptance requires you to run at least one successfully.
Continuity
The recipes run against external reference tools — c2patool, in-toto, model-signing — that Static Signal does not maintain. If Static Signal ceased operating, the recipes in your deliverable would still run and the signatures would still verify.