Terms

Terms and Conditions

The terms under which SIPRONE delivers the paid Sovereignty Assessment™, the implementation of a Federated Sovereign Node™, and the services that follow.

Version 1.0, 6 October 2026.

1. Who you are contracting with

SIPRONE B.V., a private limited company under Dutch law with its registered seat in The Hague, trading as SIPRONE, registered with the Dutch Chamber of Commerce under number 95583483, with its place of business at Doris Lessinglaan 114, 2553 ZB The Hague, the Netherlands. VAT number NL867191739B01. In these terms, "we" and "SIPRONE" mean that company, and "you" means the organisation named in the order or agreement.

2. What these terms cover and when they apply

These terms apply to every quotation, order and agreement in which we refer to them: for the paid Sovereignty Assessment™, the implementation of an FSN™ you commission afterwards, the platform services delivered on it, and the other services we provide to you, such as operations (SCIP® OPS), the Sovereign Transfer Program™, migration and consultancy. We contract only with organisations, not with consumers.

Purchasing or other terms of your own do not apply, unless we accept them in writing. Where these terms and a signed agreement between us say different things, the signed agreement wins.

A quotation is valid for 30 days, unless it states otherwise. An agreement is formed when both of us have signed it, or when we confirm your order in writing.

We may engage third parties to deliver our services, including the supplier of the platform software and hardware suppliers. We remain responsible to you for their work.

These terms are published in Dutch and in English. If the two versions differ, the Dutch version prevails.

For the free Sovereignty Readiness Scan, article 3 applies.

3. The free Sovereignty Readiness Scan

The Sovereignty Readiness Scan on our website is free and creates no obligation on either side. Nothing in it is a quotation or an offer.

The scan is a self-assessment. Its result, including the Readiness Snapshot, the recommended next step and the board questions, is generated automatically from your own answers. It is general and indicative information: not advice, not an Assessment, not a judgement about your organisation and not a promise of any outcome. No rights can be derived from it.

You use the scan at your own risk. We are not liable for decisions you take on the basis of the scan or its result, unless caused by intent or deliberate recklessness of SIPRONE's management.

The questions, the model, the scoring and the texts of the scan are our intellectual property (article 17). How we handle the data you enter is described in our Privacy Policy.

Neither an application for the Assessment nor the free Boardroom Review commits you to buy anything.

4. The Assessment

The fixed fee is €17,500 excluding taxes. It covers the complete Assessment for the organisation and infrastructure environment we agree in writing before we start.

The Assessment starts after signing and payment as agreed. We work with the people you appoint in your organisation, under the mutual non-disclosure obligations of article 20.

You receive one integrated decision document, the Sovereignty Decision Pack™, with a final judgement and a fitting proposal. That proposal follows from the findings and is not necessarily an FSN™. Where it is, the document sets out the recommended configuration, which of your existing infrastructure can be reused, the total investment that configuration requires, and the implementation route. We present it to your decision makers.

The Assessment fee is due whatever the outcome, also where the proposal is not to proceed with an implementation.

The Sovereignty Decision Pack™ reflects the information available and the circumstances at the time it is delivered. The investment figures and configurations in it are estimates, not an offer: an implementation is only agreed through a separate quotation and agreement. The Assessment does not guarantee FSN™ Admission.

The Assessment is advisory work. It is not legal advice, not a certification, not a regulator audit and not a penetration test. It does not include the final bill of materials, site validation or low-level design, which are confirmed with your IT team before an implementation starts.

The judgement and the proposal are based on the information you and your people provide and on the circumstances at the time of the Assessment. You are responsible for that information being correct and complete. The decisions you take on the basis of the Assessment remain yours.

The delivery schedule is stated in your order or statement of work after scope, evidence readiness, dependencies and available delivery capacity have been confirmed. Any pause conditions are recorded there.

5. Offsetting the Assessment fee

The Assessment fee is not offset against a later implementation, unless your agreement says so in writing.

6. Implementation and installation

An implementation covers planning, the installation and cabling scheme, installing and configuring the platform on the hardware, testing, your validation, and onboarding training for your team.

The physical installation at your site is carried out by you or by a party you appoint. We can support it as an additional service, agreed in advance.

The location, rack space, power and internet connection for your FSN™ are arranged and paid for by you.

An implementation is accepted when it has passed the agreed tests and you have confirmed acceptance in writing. It is also accepted when you take it into production use, or when you have not sent us a reasoned rejection within 10 working days after we reported it ready for acceptance. Minor defects that do not stand in the way of use do not prevent acceptance; we resolve them as agreed.

Hardware we supply comes with the manufacturer's warranty, which we pass on to you. The risk of loss of or damage to that hardware passes to you on delivery at your location.

7. Payment and collection

The Assessment fee is €17,500 excluding taxes.

The invoicing schedule and the payment term are set out in your agreement. Where your agreement does not set them, invoices are payable within 30 days of the invoice date.

The payment term is a firm deadline. If you do not pay on time, you are in default without any reminder or notice of default being needed, and you owe the statutory commercial interest from the due date (article 6:119a of the Dutch Civil Code; for public bodies, article 6:119b).

You also owe the extrajudicial collection costs. From the day after the due date, without any reminder, these are at least the statutory €40 (article 6:96(4) of the Dutch Civil Code). After a reminder, they are the amount under the scale of the Dutch Extrajudicial Collection Costs Decree (Besluit vergoeding voor buitengerechtelijke incassokosten), or our actual costs where we show that these are higher. If we go to court, you also owe all judicial costs, including the actual costs of legal assistance, in so far as the law allows.

Payments first settle the costs, then the interest, and then the oldest outstanding invoices.

You may not set off amounts you owe us against claims you have on us, or suspend payment, unless we accept this in writing. You make any objection to an invoice in writing within 14 days of the invoice date; the undisputed part remains due on the agreed date.

After a written reminder with a reasonable final deadline, we may suspend our work and services until all amounts due have been paid, and we may end the agreement in writing. Infrastructure that is still ours under article 16 may be taken back; you give us access to it for that purpose.

If you are declared bankrupt or granted a suspension of payments, or if your organisation is dissolved or its business ceases, all amounts you owe us become due immediately, and we may suspend or end the agreement with immediate effect.

Recurring charges, such as platform, support and service charges, may be adjusted once a year by the change in the consumer price index (CPI) published by Statistics Netherlands (CBS), unless your agreement says otherwise.

8. Taxes and expenses

All amounts exclude value added tax and any other applicable taxes, which are for your account. Travel and accommodation costs we make for you are charged on, unless your agreement says otherwise.

9. Changes to scope and additional work

A material change to the agreed scope is agreed in writing before we act on it, including its effect on the fee and the delivery period.

Work outside the agreed scope is quoted in advance or carried out on a time and materials basis at the rates set out in your agreement. This includes, among other things, on-site support, additional training, non-standard machine images, support when hardware is replaced or moved, capacity extensions, migrations, disaster recovery setups, maintenance of Kubernetes clusters and the applications on them, and consultancy.

10. Maintenance of the platform

Platform lifecycle, patching, upgrades, firmware handling and release governance are delivered according to the operating model and service scope recorded in your agreement.

Where SIPRONE manages a release, the applicable validation steps, deployment window, rollback approach and customer dependencies are defined by that service scope.

Updates that can affect availability are handled under the maintenance and notification conditions stated in your agreement.

Platform update, maintenance and lifecycle responsibilities are defined in your agreement and may include term-based platform or service charges.

Most maintenance does not affect availability. Where scheduled maintenance may affect it, you receive at least 7 days' notice, and we use commercially reasonable efforts to carry it out outside peak hours.

Standard machine images are kept current for the most recent operating system version. Older versions are kept current on a best-effort basis or at your request, for as long as their supplier supports them.

11. Support

The support term, service window, response targets and any renewal or extension charges are defined in your agreement.

The support scope is defined in your agreement. Where hardware assistance is included, it covers fault identification and remote support for the agreed hardware-replacement procedure, for hardware up to five years old unless your agreement says otherwise. Work outside the agreed scope is available on a time and materials basis.

Support is delivered at the service level agreed with you. That level sets the response targets and the service window, and both are recorded in your agreement. Response targets run from the moment we receive your report; they are response targets, not resolution times. Reports with critical or high priority are made by telephone, medium and low priority by email or through the portal. The rules on service levels in article 13 apply to these response targets.

Critical means a critical impact on your organisation, with visible consequences and possible financial or reputational damage. High means part of the organisation is affected or there is a reasonable risk of consequential damage. Medium means minor processes are affected but daily operations are not. Low means a service request with no operational impact.

12. Monitoring

While the platform is connected to our monitoring, hardware, platform and connectivity are monitored around the clock. Where we detect a warning or an error we act on it, and where it affects you we alert you as agreed. Monitoring helps us detect faults; it does not mean that every fault is detected in time or prevented.

Where an issue is in the hardware, we assist you but we do not act on the hardware ourselves. Where an issue is in your internet connection, it is for your provider to resolve; we inform you and can assist. The exception is the access and management switches that form part of the platform, which are ours to resolve.

13. Service levels and availability

The rules in this article apply to every service level we agree with you: for availability, for support response, for SCIP® OPS and for any other service.

A service level applies only as set out in your agreement or its service description, and only to the services and components named there. Figures on our website, in documentation or in presentations are not service levels. Service levels do not cover your own applications, data, configurations, networks and users, or products and services of third parties.

A service level is a target that we make reasonable efforts to meet: an obligation of effort, not of result, unless your agreement expressly says otherwise.

Where an availability target applies, its percentage, scope, measurement method, exclusions and remedies are defined in the applicable service agreement or statement of work. An availability target is not a financial guarantee.

In addition to any exclusions in your agreement, the following fall outside every service level: changes you request, failures in external networks, hardware failures beyond the redundancy present in the installed hardware, virus and denial of service attacks, changes carried out without our knowledge, failures at third party telecom providers, scheduled maintenance within the announced window, improper use, power problems at your location, situations in which our written advice was not followed, periods in which you did not give the access, information or cooperation we need, periods before acceptance or during a migration, periods in which we have suspended our services under article 7, circumstances beyond our control and calamities. Where we have no remote access to the platform, availability and response targets do not apply.

Our monitoring and ticket records determine whether a service level was met, unless you show otherwise. Where your agreement includes service level reports, you raise any objection within 30 days after receiving a report; after that the report is final.

Service credits apply only where your agreement provides for them. They are then the only compensation for not meeting a service level: they are limited to the percentage of the monthly charge for the affected service stated in your agreement, you claim them in writing within 30 days after the end of the month concerned, they are set off against later invoices and never paid out, and they are not due while an invoice of ours is overdue. Damages or termination are only available if the failure is also an attributable failure for which you have given us notice of default under article 22.

SCIP® OPS and other operational services are delivered as described in your agreement: the tasks, the service window, the response targets, the reporting, and the access you grant us for them. We carry out those tasks with reasonable care and within the agreed procedures. Decisions about your environment remain yours. Your applications, data and third-party licences, and changes outside the agreed tasks, are not part of the service unless your agreement says so; such work is additional work under article 9.

Service levels assume that you give us timely access, information and cooperation, keep the agreed contact persons available, follow our written advice, and keep the components you manage within their supported lifetime. Where you do not, the affected service levels do not apply for as long as that lasts.

14. Backup and recovery

You are and remain responsible for the backup and recovery of your own data, including virtual disks, object storage, databases and configurations. This also applies where the platform offers built-in or automatic backup functions, and where we have set those up or configured them for you.

You decide what is backed up, how often, for how long and where copies are kept. You keep at least one copy outside the platform, check that backups succeed, and regularly test that data can be restored.

Where we set up or run backups for you as a separately agreed service, we carry out the tasks described in that service with reasonable care. The responsibility for your data does not pass to us, and we do not guarantee that a backup is complete or can be restored.

We back up the management data of the platform itself and test our own recovery of it.

We are not liable for loss, corruption or unavailability of your data, or for its consequences, unless caused by intent or deliberate recklessness of SIPRONE's management.

15. Security responsibilities

We are responsible for the security of the platform and for the isolation between environments on it. You are responsible for the security of the resources you deploy, for identity and access management within your environment, and for threats that reach the platform through gateways or connections you open. No system is free of vulnerabilities; we do not guarantee that security incidents cannot occur.

16. Ownership, right of use and access

The infrastructure is the hardware, network equipment and other physical components on which the platform runs. Infrastructure you buy from us becomes yours once you have paid for it in full; until then it remains ours. Infrastructure you already own stays yours. The data on it are yours.

The platform, meaning the platform software, its management layer, updates and documentation, runs on the infrastructure but is not part of it, and it is not sold. You receive a non-exclusive, non-transferable right to use it for the term of your platform agreement, under the licence conditions set out in that agreement. You do not become the owner of the platform or of any part of it; ownership of and intellectual property in the platform remain with us or our supplier. You may not copy, change, decompile or pass on the platform, or grant others a right to use it, except where the law allows this or your agreement says so. The right of use ends when the platform agreement ends.

Neither we nor our suppliers have standing access to your workloads or data. The platform keeps a management connection for monitoring, updates, licence checks and the management of the platform itself, as described in your agreement. Any other access requires your permission, which you can withdraw.

17. Intellectual property, Sovereignty Decision Architecture™ and deliverables

Sovereignty Decision Architecture™, the Sovereignty Readiness Scan, the Sovereignty Assessment™, our other methods, models, scoring, frameworks, templates and documentation, and the structure and format of the Sovereignty Decision Pack™ are our intellectual property, as are our names and marks, including SIPRONE, SCIP®, FSN™, GFSS™, STP™ and Sovereignty Decision Architecture™. Nothing in these terms or in an agreement transfers them to you.

You receive a non-exclusive, non-transferable right to use the Sovereignty Decision Pack™ and any other report, pack or deliverable we provide within your own organisation, including with your advisers and your supervisory authority, for the purpose for which it was provided. You may not publish or sell them or use them to provide services to others, and you may not use our methods or marks without our written permission.

We do not publish the Decision Pack or your information.

18. Sovereign Transfer Program™

Under the Sovereign Transfer Program™ (STP™), operational tasks for your environment can be transferred to your own team, step by step and only where your agreement provides for it. The scope, the steps, the readiness criteria and the support we give are set out in that agreement.

A transfer concerns operational tasks and knowledge. It does not transfer ownership of the platform or of any intellectual property; your right of use under article 16 and the licence conditions of the platform continue to apply.

Training and certification of your people show that they completed the programme; they do not guarantee how they perform. From the moment a task has been transferred, you are responsible for carrying it out and for its consequences, and the service levels for that task no longer apply, unless your agreement says otherwise.

We are not liable for damage caused by actions or omissions of your team or of third parties you engage, also after a transfer, unless caused by intent or deliberate recklessness of SIPRONE's management.

Where a transfer depends on a capability of our supplier that is not yet available, such as an edition of the platform that you can operate yourself, the timing of the transfer depends on that availability. We do not promise a date for it, unless your agreement does.

19. Sovereignty, compliance and our statements

Sovereignty, control and independence are design goals of our approach and our architecture. We do not guarantee a legal, regulatory or political outcome. Whether an authority, in the Netherlands or elsewhere, can claim access to data, systems or services depends on laws, treaties, court decisions and facts outside our control, including where you, your suppliers and your users are based and which services you connect.

You remain responsible for complying with the laws and regulations that apply to you, including data protection, sector rules, security requirements and export controls. Our Assessment, advice and services support your decisions. They do not replace your own legal, compliance and security advice, and they do not guarantee compliance, certification or approval by a regulator.

Products and services of third parties that you use or connect, such as cloud services, software, hardware and connectivity, fall under the terms of those third parties. We are not responsible for them, nor for their effect on your sovereignty or compliance.

Statements on our website, in presentations, brochures and other material describe our approach and capabilities in general terms. They are not part of the agreement and create no obligation, unless your agreement includes them expressly. The agreement and these terms contain everything we have agreed on their subject.

We are not liable for the consequences of changes in laws or regulations, of sanctions, or of measures, orders or claims of authorities, unless caused by intent or deliberate recklessness of SIPRONE's management.

20. Confidentiality and non-disclosure

Both parties keep the other's confidential information confidential. Confidential information is all information that a party receives from the other in connection with an engagement and that is marked as confidential or should reasonably be understood to be confidential, including information about systems, security, architecture, data, prices, quotations, methods and the Sovereignty Decision Pack™.

The receiving party uses it only for the engagement, shares it only with its own employees, advisers and the third parties it engages who need it for that purpose, makes sure that they are bound by the same obligations, and protects it with at least the care it uses for its own confidential information.

Before the Assessment starts, both parties sign a mutual non-disclosure agreement. Until then, and for any other work, this article applies as a mutual non-disclosure agreement. Where a separate non-disclosure agreement has been signed, it prevails.

These obligations do not apply to information that is public, that the receiving party already had or developed independently, or that must be disclosed by law, a court or a regulator; in that last case the other party is informed first where that is allowed.

On request, each party returns or deletes the other's confidential information, except where the law requires it to be kept. These obligations continue after the engagement ends, for as long as the information remains confidential.

21. Personal data

How we handle personal data is described in our Privacy Policy. Where we process personal data on your behalf, we agree a data processing agreement before that processing starts. It names the suppliers that process personal data for us.

22. Liability

We are only liable for damage that results from an attributable failure by us in performing the agreement. That liability only arises if you have first given us written notice of default without delay, describing the failure as precisely as possible and setting a reasonable period for us to remedy it, and we are still in breach after that period. No notice is needed where remedying the failure has become permanently impossible.

Our total liability for claims connected to an engagement is limited to the amount invoiced for that engagement, excluding taxes. For platform and other continuing services, it is limited to the charges invoiced for the twelve months before the event that caused the damage.

We are never liable for indirect or consequential loss, including lost profit, lost savings, loss or corruption of data, reputational damage, business interruption, fines or penalties imposed on you, and claims of third parties. Nor are we liable for damage caused by your instructions, choices or information, by not following our written advice, or by products and services of third parties.

These limits do not apply to damage caused by intent or deliberate recklessness of SIPRONE's management, or to anything that cannot be limited under Dutch law.

Any right to compensation requires that you report the damage to us in writing as soon as possible after it arises. A claim lapses if you have not reported it to us in writing within twelve months after you discovered the damage or could reasonably have discovered it.

You indemnify us against claims of third parties, including your own customers and users, connected to your use of our services, unless the damage is caused by intent or deliberate recklessness of SIPRONE's management.

These limits and exclusions also protect our employees and the third parties we engage, who may rely on them themselves.

23. Term, cancellation and the end of the agreement

You can cancel an Assessment before kickoff. You then owe the work already carried out, and any prepayment above that amount is returned. After kickoff the full fee is due, and you receive whatever has been produced up to that point.

An implementation can be cancelled up to the moment hardware is ordered. After that, ordered hardware and work already carried out are due in full.

Platform and other continuing services run for the term in your agreement. Unless your agreement says otherwise, that term renews for the same period each time, unless either of us ends it in writing at least three months before it expires.

When the platform agreement ends, the platform services and your right of use end, and the platform software is removed. Infrastructure that is yours and your data remain yours. Before deployment and again before exit, the parties document the supported export and migration route for the workloads in scope. You export your workloads and data before the end date; we support that at the rates in your agreement. After the end date, data that is still in the platform may no longer be accessible. Cross-platform migration can require planned downtime or separately licensed third-party tooling; no generic zero-downtime or universal-format promise is made.

24. Circumstances beyond our control

If something outside our reasonable control prevents delivery, the obligation is suspended for as long as that lasts. This includes failures of our suppliers, such as the supplier of the platform software, hardware manufacturers and telecom providers, where we could not reasonably have prevented them. If it lasts longer than 60 days, either of us can end the engagement in writing, and you pay only for what was delivered.

25. Applicable law and disputes

These terms, every agreement between us and every claim that arises from or relates to them, including non-contractual claims, are governed exclusively by Dutch law, also where you are based outside the Netherlands. A choice of another law in your purchasing terms or other documents has no effect. The United Nations Convention on Contracts for the International Sale of Goods (the Vienna Sales Convention) does not apply.

Disputes go before the competent court in The Hague, unless mandatory law says otherwise. We may also bring a claim before the court that has jurisdiction where you are based.

26. Changes to these terms

We can change these terms for future engagements. The version that applies to your engagement is the one in force on the date of your order, and we give you that version on request.