Business Continuity and Keyout Policy

Each customer's cryptographic key material is generated and held as non-extractable material in AWS KMS within a dedicated, single-tenant AWS account provisioned for that customer. No one, including SanctiKey, can extract or export the raw key bytes. During normal operation, SanctiKey operates these keys to perform the operations the customer requests via the Service's API; customers do not hold direct AWS credentials, which keeps the account's attack surface minimal.

Independence is secured by the Keyout right (Section 3). When Customer exercises the buyout, Customer designates an IAM role in Customer's own, separate AWS account (the "Escrow Access Role"). Before SanctiKey's managed layer is decommissioned, the Escrow Access Role is granted the ability to make direct AWS KMS API calls against Customer's keys, so cryptographic access is uninterrupted from initiation through final account transfer.

From the moment a Customer-controlled principal (including the Escrow Access Role) is granted on a key policy, responsibility for the continuity, security, and integrity of access made through that principal rests with Customer. SanctiKey's liability boundary ends where Customer-controlled access begins.

This means that even in a scenario where SanctiKey's managed service layer becomes unavailable, customers retain:

• Full ownership of their cryptographic key material, isolated in their dedicated account
• The ability to make direct AWS KMS API calls using the Escrow Access Role designated at buyout initiation
• Access to their encrypted data, subject to their own key management practices

SanctiKey's managed service layer provides abstraction, compliance tooling, and operational simplicity on top of this key material, but the key material itself is never dependent on the continued operation of SanctiKey's software or managed service layer. Key material remains in the dedicated tenant account while the account is in good standing; on termination without an executed Keyout, key material and account data are deleted in accordance with the Terms of Service and the Data Retention Policy.

SanctiKey's Service is built on regionally resilient AWS serverless services. Availability commitments are governed by the Service Level Agreement.

Customers may request delivery of their audit logs at any time by emailing support@sanctikey.com; SanctiKey fulfills export requests from the account's audit records. SanctiKey recommends that customers periodically request and retain audit exports as part of their own business continuity practices.

The Keyout right grants customers the ability to acquire operational ownership of their SanctiKey tenant AWS account, including their keys and audit records. This right exists to ensure that no customer's cryptographic keys are ever hostage to its vendor, including SanctiKey: a customer with a valid, paid-up subscription may take independent ownership of its account for any reason.

The Keyout right is available to Customer at any time during the active Subscription Term, provided the subscription is valid and paid up, and may be exercised by Customer for any reason. It is customer-initiated; SanctiKey does not initiate it. Exercise is not contingent on SanctiKey ceasing or intending to cease operations. Questions about continuity scenarios beyond this Policy: ask us at legal@sanctikey.com.

Execution of the Keyout requires payment of an exit fee. The fee is a published formula, not a negotiated amount:

Buyout fee = the greater of (a) USD $1,000, or (b) 24 x the Customer's trailing twelve-month average monthly bill.

For an account active fewer than twelve months, the trailing average is computed over the full account lifetime. Because the fee is derived from historical billing rather than account state at the time of exercise, it is not reduced by lowering usage or deleting keys immediately before exercising the right.

Examples:

• Steady $49/mo average (1 key): max($1,000, 24 x $49 = $1,176) = $1,176
• $157/mo average (10 keys): max($1,000, 24 x $157) = $3,768
• $637/mo average (50 keys): max($1,000, 24 x $637) = $15,288

Exit fees are non-negotiable and must be paid in full via Stripe before Phase 1 of the buyout process initiates. SanctiKey's orchestration systems are designed to verify confirmed Stripe payment before executing any buyout phase.

At initiation, Customer designates the Escrow Access Role (Section 2.1): an IAM role in an AWS account owned by Customer, which must be a different AWS account than Customer's SanctiKey tenant account. The Keyout then proceeds in three phases following confirmed payment:

Phase 1: Compute Demolition (Day 1)

SanctiKey's managed compute layer (Lambda functions, API Gateway configurations, and IAM orchestration) is decommissioned from Customer's tenant environment. Customer's AWS KMS keys and key material remain fully intact and operational throughout this phase.

Following Phase 1, Customer retains uninterrupted cryptographic access via direct AWS KMS API calls using the Escrow Access Role. The Escrow Access Role is granted use of Customer's KMS keys before compute demolition begins, so there is no gap in cryptographic access. SanctiKey's managed service layer is no longer present, but Customer's keys and encrypted data remain fully accessible and operational.

Phase 2: Transition Quarantine (Days 2 through 90)

During this 90-day period, Customer's AWS account remains within SanctiKey's AWS Organization. This period allows AWS CloudTrail management event history, which contains SanctiKey's proprietary infrastructure deployment parameters, Lambda environment configurations, and IAM choreography, to age out completely before account transfer.

This phase is non-disruptive to Customer. Customer retains full access to key material and encrypted data via direct KMS calls throughout. The quarantine period is a SanctiKey IP protection measure that operates invisibly in the background.

Phase 3: Account Ejection (Day 91)

On Day 91, Customer's AWS account is formally ejected from SanctiKey's AWS Organization and transferred to Customer's independent ownership. At this point, Customer takes full, independent operational ownership of the account and the conveyed materials described in Section 3.5.

Following ejection, SanctiKey has no further access to, responsibility for, or involvement with the transferred account.

Upon completion of Phase 3, Customer receives:

• Full ownership of the AWS account containing their tenant environment
• All AWS KMS keys and key material within the account
• The DynamoDB audit table and its entries within the account

These are the conveyed materials. No other resource class is conveyed.

The following are explicitly excluded from the Keyout:

• SanctiKey’s proprietary Lambda function source code and binary packages
• SanctiKey’s proprietary API Gateway configurations and deployment templates
• SanctiKey’s proprietary IaC blueprints and CloudFormation templates
• SanctiKey’s trademarks, brand assets, and documentation
• Any SanctiKey intellectual property; these items are decommissioned and removed during Phase 1

Customer receives the account, their keys, and their audit records. Customer does not receive SanctiKey's software.

Customer is responsible for:

• Maintaining current payment information to facilitate exit fee collection
• Engaging AWS support or an AWS partner to assume ownership of the transferred account if needed
• Migrating any production integrations off SanctiKey’s API endpoints before or during Phase 2
• Managing the transferred AWS account independently following Phase 3 ejection