Always on. Always answerable.

Yes. The data plane is decided per system in the Define phase and recorded in the architecture register: a Swiss region, the European Union, Jordan or the Gulf state concerned, the United States, your own data centre or a national cloud. Speech, language and other models run inside that plane; the control plane holds policy, identity and metrics and never a meter read or a customer record. For an on-premises deployment the proposal states what the operator provides — hardware, network, identity — and which model options fit that footprint, so the residency commitment is priced rather than promised.

As design inputs, not as a compliance review at the end. The obligation register written in the Discover phase lists every requirement that touches the engagement — risk-management measures, incident-reporting windows and the path to the authority, supply-chain security, management accountability, the evidence a reliability audit expects for each critical asset — with an owner and the artefact that will show it is met. Altuon is a supplier in your chain under NIS2, and the agreement carries the security commitments, audit rights and notification duties you need to include us in your own supplier register. Where the operator has an existing framework, the register is mapped to it rather than duplicated beside it.

Only where the mandate says so, and then in one direction. The default boundary is read-only access to a historian or a data-diode replica, never a write path into a control system, and the boundary is drawn in the architecture register with the head of network operations before any integration is designed. Where the engagement does require a change on the control side, it is built and tested in a replica of the environment, follows the operator's own change-control procedure, is rehearsed with a rollback, and is scheduled with operations rather than around them. Nothing Altuon deploys makes an autonomous decision that acts on the network.

Behind a compatibility layer, one consumer at a time. The existing system remains the system of record while each dependent application is moved across and reconciled: every meter read, every tariff calculation and every invoice line is compared between old and new for at least one full billing cycle before the old path is retired, and any discrepancy blocks the cut-over rather than being explained later. Rollback is rehearsed before the first migration, not designed after the first problem. The migration plan and the reconciliation reports are deliverables you keep, and the sequence is governed by the case your board approved, with the option to pause at any step.

Capacity is provisioned for the peak, not the average: telephony and speech services scale on demand, and the line is load-tested at several times the highest volume the operator has recorded. When the network model has no confirmed fault, the agent says exactly that: the report has been logged, the address confirmed, crews are being dispatched by priority, and the caller will be told when an estimate exists. It never invents a restoration time. If speech recognition or the network model degrades, the line falls back to a structured menu that still takes the report and still reaches a person, and the handover to a human agent carries the whole context of the call. A voice agent that cannot say it does not know has no place on a line people call in the dark.

The operator owns the code, the models fine-tuned on its data, the evaluation sets, the obligation and architecture registers, the migration and reconciliation records and the documentation, assigned on payment. Exit terms are written into the agreement: a notice period, a transition plan, the handover of every environment and credential, and the deletion or return of data with a written confirmation. Key-person risk is addressed by pairing every role from the first week, by writing decisions down as they are taken rather than reconstructed at the end, and by naming in the proposal the people who will do the work and the people who will replace them if they cannot. The operator should expect to see the exit terms before it sees a demonstration.