One versioned starting point for a governed pilot.
Pack 1.0.0 · candidate effective date July 28, 2026. Templates become binding only through a completed and signed Order Form.
No production data before execution. A public form is for non‑sensitive qualification only. Credentials, production detail, regulated data, and incident or vulnerability material require an executed agreement, approved scope, and the customer‑controlled secure exchange below.
Agreement set
Every file is committed by SHA‑256 in the public clavenar.customer-legal-exchange/v1 contract. A changed byte requires a new pack version and renewed approval.
| Document | What it covers |
|---|---|
| Master Services Agreement | Services, confidentiality, IP, support, warranties, liability, term, termination, and deletion. |
| Pilot Agreement | Evaluation scope, owners, success evidence, change control, production prohibition, and exit. |
| Order Form | Parties, exact versions, commercial fields, deployment, data, exchange recipients, transfers, and signatures. |
| Data Processing Addendum | Roles, instructions, confidentiality, security, subprocessors, assistance, incidents, audit, transfer, return, and deletion. |
| SCC Election & Appendix | Official EU SCC incorporation, Module 2/3 elections, Annexes I–III, UK boundary, and supplementary measures. |
| Security & Data Schedule | Identity, isolation, encryption, release security, incidents, recovery, retention, deletion, and shared responsibility. |
| Procurement Response | Truthful standard answers, evidence boundary, explicit non‑claims, and customer‑specific completion fields. |
Read the pack index. Bracketed fields, offer version, price, term, region, support, transfer details, and signatures must be completed before an agreement is operative.
Customer-controlled secure exchange
The downloadable local‑only tool creates a bounded dual‑recipient envelope using X25519, HKDF‑SHA‑256, and AES‑256‑GCM. One private key stays with the customer. The second recipient is order‑specific and must be verified through an authenticated channel. The Website publishes no universal recipient and receives no plaintext, key, or envelope.
- At most 128 files, 8 MiB per file, 16 MiB aggregate, and 168 hours.
- Exact path, size, SHA‑256, recipient, creation, and expiry bindings.
- Symlink, traversal, duplicate, wrong‑key, substitution, alteration, and expiry rejection.
- Customer‑controlled storage, access audit, revocation, deletion, and retained customer decryptability.
Scope and assurance
The pack does not create a public offer, price, service level, certification, production approval, or customer relationship. Those require completed Order Form fields and signatures. The Procurement Response marks SOC 2, ISO 27001, PCI DSS, HIPAA/HITRUST, and FedRAMP as not claimed; customer‑specific evidence availability is confirmed before signature.
Questions or a request for a customer‑specific completion can be sent to contact@clavenar.com. Do not include credentials, production detail, regulated data, or incident/vulnerability material.