Nothing stops. Nothing leaves the site.

Yes. The data plane is decided per system in the Define phase and recorded in the architecture register, and for a plant it is usually the plant itself: servers in the site's own racks, on the site's own network segment, with no route to the internet. Language, retrieval and speech models run inside that footprint; the proposal names the hardware the plant provides, the model options that fit it and the process for updating them from media the site controls. Where the group prefers a national cloud or its own data centre, the same register records that instead. Nothing about the plant is processed on infrastructure the plant has not approved.

By never touching them. Integration reads from the systems that already sit above the controllers, the historian, the manufacturing execution system and the enterprise resource planning system, through interfaces they already expose, and it writes only to the systems of record on the business side. The network design follows the IEC 62443 model of zones and conduits: anything Altuon deploys sits in a zone the plant's operational-technology owner defines, crosses only the conduits he approves, and is documented in the plant's own asset inventory. Where a data diode or a one-way replication is the site's policy, the architecture is built to it rather than around it.

In both directions. Supplier and counterparty intelligence is gathered from lawful, public and licensed sources, with provenance recorded to the line, so a sanctions or ownership finding can be shown to have been reached properly; Altuon does not procure information it could not describe the origin of. In the engagement itself, technical data about controlled goods is treated as controlled: the proposal names who on the Altuon side will see it, under which nationality and location constraints, and the agreement carries the technology-control plan the client's compliance officer requires. Classification decisions stay with the client; Altuon prepares the evidence.

Only if the case supports it, and often it does not. The Discover phase maps every system of record, what depends on it and what it would cost to stop, and the resulting strategy names which systems remain, which are wrapped behind an integration layer so the group can read them together, and which are retired, in an order that keeps every plant running. A single system is one of the options assessed, not the assumption. Altuon holds no reseller agreements with enterprise software vendors, and the recommendation is written so the board can see what was compared and why.

The client does. Models trained or tuned on the plant's data, the evaluation sets, the integration code, the intelligence archive with its sources, and every brand asset with its licences are assigned to the client on acceptance and delivered in formats the client can maintain without Altuon. Third-party components are listed with their licences before they are used. The exit terms are written into the agreement at the start: the handover period, the documentation standard, the training of the client's own people and the deletion of anything Altuon still holds, with a certificate to show for it.

The design makes that the failure mode Altuon plans against. Changes are made in agreed maintenance windows with a rehearsed rollback and an acceptance test the plant's own engineers run; production systems are never the first place a change is seen. Liability, indemnity and the limits that apply are stated in the agreement rather than in a schedule the plant finds later, and Altuon carries professional indemnity and cyber cover whose certificates are provided during procurement. Support is defined per system in the service schedule, with response times that match the plant's shift pattern and named people on both sides, so a fault at three in the morning reaches an engineer who knows the site.