Aerospace Telemetry Data Processing Addendum

1. Purpose-Bound Processing & The Zero-Copy Guarantee

1.1 Zero Foundation Model Training: Processor strictly agrees and warrants that Customer Spacecraft Telemetry, FMECA fault trees, flight operations manuals, and investigation reports shall never be copied, utilized, or retained to pretrain, fine-tune, or calibrate public or proprietary general-purpose artificial intelligence models.

1.2 Tenant Isolation: All telemetry, graph data and investigation records are logically segregated by tenant, with every read scoped to the caller’s tenant. Per-tenant envelope encryption and egress identifier pseudonymisation are available as deployment settings.

2. Authority Level A0 Advisory Demarcation (ADR 0018)

2.1 Advisory Boundary: Controller expressly acknowledges that Jantar operates at Authority Level A0 (Advisory Only). Processor provides automated diagnostic hypotheses, causal graph traversals, and proposed recovery procedures.

2.2 Commanding Responsibility: Controller’s certified flight directors retain sole, non-delegable authority for verifying and executing any recovery command to the spacecraft. Processor shall have zero direct connectivity, hardware transmission line, or commanding authority over any satellite transmitter.

3. IN-SPACe SSA Guidelines & Statutory EUC Terms

3.1 Statutory Annexure-3 EUC: Pursuant to Section B.13 and Section C.III.c.i of the IN-SPACe SSA Guidelines (IN:ISP2023:NGP-SSA:2026/V1.0), Controller represents that it holds any space activity authorisation from IN-SPACe required for its own operations and executes the statutory End-Use cum End-User Certificate (Annexure-3) incorporated into this Agreement.

3.2 Three-Year Audit Maintenance: Both Processor and Controller agree to maintain executed EUC records in an append-only, hash-chained ledger and investigation metadata in an append-only audit trail, designed for retention of a minimum of three (3) years for inspection by IN-SPACe or authorised agencies of the Government of India.

4. National Security RSO Designations (Section B.7)

Pursuant to Section B.7 of the IN-SPACe SSA Guidelines, Controller agrees that under no circumstances shall Jantar be tasked to track, identify, associate, or disseminate data regarding Resident Space Objects (RSOs) designated as classified or strategic by the Government of India. Once a designation is registered with Processor, references to the designated object are redacted from investigation reports and outbound notifications by Processor's designated-object redaction filter.

5. Data Retention & Cryptographic Shredding

5.1 Post-Pilot Data Purge: Subject to Clause 5.3, upon conclusion or termination of an evaluation pilot or service agreement, Controller may request full deletion of all stored telemetry arrays, vector embeddings, and temporary investigation state. Processor shall execute that deletion, including cryptographic shredding where per-tenant encryption is enabled, within seventy-two (72) hours of receipt of written demand.

5.2 Statutory Security Logs: Cyber incident and forensic access logs required under the CERT-In Directions 2022 shall be preserved in append-only storage within India for the applicable statutory retention period (180 days under the CERT-In Directions 2022; up to three (3) years where the IN-SPACe SSA Guidelines apply), after which entries are expired under the retention window configured for the deployment. Write-once object-lock retention is roadmapped.

5.3 Statutory Retention Carve-out (DRAFT — subject to counsel review): This clause is a draft, is not yet in force, and is published for transparency pending review by counsel. The post-pilot purge in Clause 5.1 and the zero-copy commitment in Clause 1 do not extend to: (a) executed End-Use cum End-User Certificates (Annexure-3) and investigation audit metadata, which are retained for three (3) years where the IN-SPACe SSA Guidelines (IN:ISP2023:NGP-SSA:2026/V1.0, Sections B.13 and B.21) apply; (b) raw-data linkage records, which are retained for six (6) months under Section C.III.e; and (c) logs required under the CERT-In Directions 2022, which are retained for 180 days. For the purposes of this Addendum, "zero-copy" means that telemetry content is not reused, is not used for model training, and is purged on request. The carve-out covers metadata and certificates only and never extends to telemetry content.

6. Geographic Location & Sovereign Sub-processors

Unless deployed in an air-gapped on-premises enclave at Controller's ground station, Jantar’s cloud infrastructure, including its databases and stored records, runs in Google Cloud’s Mumbai region. The providers below also process data in the course of the service, some of them outside India:

Public catalogues queried (not sub-processors). When an operator checks which satellite acquisitions cover an area in Jantar Earth, the service sends that area’s bounding box (the latitude and longitude extent of the points the operator gave) and the requested date range to NASA’s Common Metadata Repository (CMR), a public United States Government catalogue, to list the NISAR radar acquisitions over it. The query is anonymous: it carries no account or credential and no telemetry, tenant or personal data, only the box and the dates. NASA logs such queries under its own policies and processes nothing on Controller’s behalf, so it is not a sub-processor. Displacement measurement, which would download those acquisitions, is not currently offered.

Likewise, when an operator searches the Bhoonidhi catalogue of ISRO’s National Remote Sensing Centre (NRSC) through Jantar, the service sends the collections searched and, when the operator gives them, the search area’s bounding box and the date range to NRSC’s Bhoonidhi service, operated by the Government of India; downloading a scene sends that scene’s identifier and its collection. Unlike the NASA query, these requests are made under SKOPAQ’s registered Bhoonidhi account, so NRSC can associate them with SKOPAQ. They carry no telemetry, tenant or personal data. NRSC processes nothing on Controller’s behalf and is likewise not a sub-processor.