Eight stages from intake to delivery.
What happens, in order, and what would stop it at each stage.
The last stage is yours: acceptance means you ran a verification recipe against your own copy and it reproduced.
The eight stages
Verification
Every deliverable includes verification recipes. Run them against your copy of the dataset:
The exact commands ship inside the deliverable. Each command is tested against that deliverable before release, and acceptance requires you to run at least one successfully.
Continuity
The recipes run against external reference tools that Static Signal does not maintain: c2patool, in-toto, model-signing. If Static Signal ceased operating, the recipes in your deliverable would still run and the signatures would still verify.
Questions
What do you actually deliver?
Four artefacts: a versioned dataset, a Merkle integrity proof, a provenance bundle, and an EU AI Act evidence pack covering Articles 10, 11 and 12. Articles 9, 14 and 15 stay with the provider deploying the system. Verification recipes ship alongside them and run against tools Static Signal does not maintain: c2patool, in-toto and model-signing.
How do I know the dataset is what you say it is?
Acceptance requires running one verification recipe successfully. The recipes execute against external tools, so the check does not depend on trusting Static Signal. If it does not reproduce, it has not been delivered.
What happens to our raw data?
Raw inputs are deleted within 30 days of acceptance. Deletion on request is completed within 7 working days and returns a signed attestation. Custody is bounded by the signed engagement scope and a GDPR Article 28 DPA.
Which provenance standards do you use?
Four layers: SHA-256 content and schema fingerprints, branch-aware Merkle trees, C2PA content credentials carried as a sidecar manifest that references the dataset by hash, and SLSA v1.2 build attestations. The signer is selected by policy, not by environment; a signing attempt that cannot proceed raises and writes nothing.
What does an engagement cost and how long does it take?
Tier and range are quoted at intake against volume, modality and compliance deadline. The processing window starts when receipt of the raw data is acknowledged with a SHA-256 manifest.
What happens if the data fails validation?
Failed validation blocks the build and the refusal is recorded in the refusal log. Validation runs six tiers (structural checks, subject gate, data quality, perceptual quality, categorical assessment and consistency), four of which gate; advisory findings are recorded as advisory.