Procurement-facing. Continuity package.
Continuity and bus-factor.
Hire is operated by a small team on dedicated hardware. Enterprise procurement reasonably asks what happens to delivered work, undelivered orders, and the zero-data-retention posture if the operating company exits, fails, or is acquired. This page answers that question structurally. Not “available on request.” In effect, today, for any engagement that crosses the threshold defined below.
The honest framing.
Pitching radical statelessness to a CISO while the operating company is one founder and a Mac Mini undercuts the trust pitch. The architectural answer (no customer content store, no breach surface) is real. The operational question (what if the operator disappears) is also real. We answer both.
The three mitigations below are not aspirational. They are policy commitments that attach automatically to any enterprise engagement above the threshold. No legal dance, no “our team will get back to you,” no MSA negotiation gating the answer.
Source escrow.
The Hire processing pipeline (job-execution code, catalog definitions, deployment scripts, infrastructure-as-code, model weights for the local-inference layer) is placed in third-party source escrow at the point of an engagement crossing the threshold. Escrow agent, jurisdiction, and release conditions are documented in the engagement rider.
Release triggers: operating-company insolvency, voluntary or involuntary cessation of operations, sustained service outage exceeding the SLA cure period, or material breach of the engagement without remediation. On any trigger, the escrow agent releases the package to the customer for self-hosted continuity.
Operational consequence: a catastrophic outcome at the operating company does not strand your delivered work, your in-flight orders, or your team's ability to keep running the catalog locally. The handoff is mechanical, not negotiated.
Acquisition poison-pill.
The thing that breaks “zero data retention” trust most reliably is not a breach. It is an acquisition where the new owner's economics depend on turning the customer base into training data. We have written that outcome out of the engagement structure.
The clause: on any change of control of the operating company, the following commitments survive without modification for the duration of the existing customer relationship and any renewal: zero data retention, no model training on customer inputs, fixed per-deliverable pricing for catalog items, and the architectural prohibition on building persistent customer-content stores.
If the acquirer refuses the survival clause, the engagement converts to a customer-controlled exit: the source-escrow package releases on closing, and the customer receives a pro-rated refund of any pre-purchased credit balance plus a defined transition window. The acquirer cannot retroactively change the contract.
Architectural posture preservation.
Source escrow protects code. The poison-pill protects contractual posture. The third mitigation protects the architectural decisions that make the first two worth anything.
The commitment: stateless processing, zero customer-content persistence, on-premises inference, and the metadata-only audit-trail design are documented as binding architectural constraints in the engagement rider, not as marketing claims. The operating company is contractually prohibited from migrating the engagement to a persistent-state architecture, a third-party AI vendor pipeline, or a cross-border processing chain without the customer's signed acceptance.
Operational consequence: the vendor cannot quietly drift toward a more conventional SaaS architecture under cost pressure or growth pressure. If the architecture changes, the customer is informed and given an out, not a notification email a week before cutover.
Engagement threshold.
The three mitigations attach automatically to any enterprise engagement at or above $5,000 of pre-purchased commitment (single Department Budget Block, consolidated invoice arrangement, or the equivalent on a custom schedule). Below the threshold, individual catalog purchases are governed by the standard public refund and SLA terms; the bus-factor concern is addressed by the per-job transactional model itself, since no pre-paid commitment is at risk.
Crossing the threshold: the engagement rider is generated automatically at credit-block purchase or on the first invoice consolidation. No back-channel conversation is required to activate the protections.
Cross-portfolio lineage.
The escrow and poison-pill templates are shared across the No Human Nearby enterprise suite (REDLINE, DATAROOM, COVENANT). The lineage matters because the templates have already been negotiated with counsel for adjacent procurement contexts. Hire's adoption is a light modification of language that is already battle-tested, not a from-scratch draft on the day your engagement starts.
For your counsel: redline of the rider is welcomed during onboarding. Material changes flow back to the portfolio templates, so your scrutiny benefits the next procurement org as well.
Procurement next step.
The fastest path to engagement remains a low-stakes catalog purchase to validate output quality and operational fit. The continuity protections above are not gated on a heavy validation phase. They activate at the moment a Department Budget Block is purchased or an invoice-consolidation arrangement begins.
For redline review of the engagement rider, escrow-agent selection, or threshold-customization conversations, contact [email protected]. We respond inside one business day.
This document is informational. Specific contractual terms are negotiated per engagement. Where this document conflicts with an executed agreement, the executed agreement governs.