Change Calendar · forward-looking

Every planned change — announced before it lands.

Tier-1 procurement teams need to plan their own change-management cycles. We publish ours: every breaking change, sub-processor addition, maintenance window, and policy revision — with the announce-date and effective-date, before they take effect. The minimum-notice policy is locked.

Trust CentreHistorical changelog

Change Calendar, step by step

Demo data

You learn: What happens at each step. You can: Step through it.

  1. Step 1 of 4

    KYE Protocol™

    Breaking changes

    to published APIs, JSON Schemas, OpenAPI surfaces, wire formats, or signed-envelope shapes carry ≥ 90 days notice from the announcement to the effective date. Customer-side opt-out window is included.

  2. Step 2 of 4

    KYE Protocol™

    Sub-processor additions

    (new third-parties touching customer data) carry ≥ 30 days notice (GDPR Art. 28(2) + customer DPA ). Customers can object to a specific sub-processor; if KYE™ cannot accommodate the objection, the customer's right to…

  3. Step 3 of 4

    KYE Protocol™

    Maintenance windows

    on customer-visible surfaces carry ≥ 7 days notice. Emergency maintenance for security incidents is announced immediately via the status page and customer security contact.

  4. Step 4 of 4

    KYE Protocol™

    Every entry on this page is also represented in the machine-readable JSON at…

How this widget is built
Demonstrates
KYE Protocol™
Components
  • The steps this page describes
Flow
Each step in order, as the page sets it out. Architecture diagram
Used on

90 days

minimum notice for breaking changes to APIs, schemas, or wire formats

30 days

minimum notice before any new sub-processor begins processing customer data (GDPR Art. 28(2))

7 days

minimum notice for planned maintenance touching customer-visible surfaces

1 · Upcoming scheduled changes

Every entry has an announce-date and an effective-date.

Procurement scripts: curl -s https://kyeprotocol.com/change-calendar.json | jq '.entries[] | select(.status == "scheduled")'. Schema: kye.change_calendar.v1.

feature launch

scheduled

Pilot 1 onboarding window opens (tier-1 banks)

Audit Pilot™ engagements open for tier-1 global bank pilots. Pilot scope is shadow-mode AI-agent governance against a published baseline; outputs are 30-day evidence packs.

Announced 2026-05-20 · Effective 2026-06-15 · Scope tier-1 pilots · Customer action not required · Apply for pilot

feature launch

scheduled

EU data-residency router — operational verification (per-tenant)

Gateway data-residency middleware ships — operational per-tenant verification rolls out to EU tenants. Default-deny if region tag missing.

Announced 2026-05-20 · Effective 2026-07-01 · Scope EU tenants · Customer action not required · EU AI Act mapping

feature launch

scheduled

Production HSM provisioning for BYOK signing keys

Production HSM-backed signing keys (@kye/byok) provisioned by operator. Replay-Proof™ envelopes verifiable from operator-rooted public keys alone.

Announced 2026-05-20 · Effective 2026-09-30 · Scope all tenants · Customer action not required

policy revision

scheduled

SOC 2 Type II auditor engagement (SSAE 18)

SSAE 18 auditor engagement begins for SOC 2 Type II attestation. Control mapping is already shipped. Expected report delivery 3-6 months from engagement start.

Announced 2026-05-20 · Effective 2026-11-30 · Scope all tenants · Customer action not required · Trust Centre

policy revision

scheduled

ISO/IEC 27001 external audit engagement

External audit engagement for ISO/IEC 27001 certification. SoA (Statement of Applicability) shipped. Expected certification 2-4 months from engagement start.

Announced 2026-05-20 · Effective 2026-09-30 · Scope all tenants · Customer action not required · Trust Centre

policy revision

scheduled

External penetration test (Q2/Q3 2026)

Threat-led penetration test engagement, ~2-4 weeks. Report becomes available to tier-1 pilot customers under NDA + published Trust Centre status update.

Announced 2026-05-20 · Effective 2026-08-15 · Scope all tenants · Customer action not required

feature launch

scheduled

v1.1 profile preview (additive only — no breaking changes to v1.0)

v1.1 introduces additional rule-pack + sector-pack additions on top of the 10 canonical profiles locked in v1.0. v1.135 conformance fixtures remain bit-for-bit stable.

Announced 2026-05-20 · Effective 2026-09-15 · Scope all tenants · Customer action not required · Historical changelog

2 · Notice policy

The policy is locked. Notice windows are minimum-floors, not targets.

  • Breaking changes to published APIs, JSON Schemas, OpenAPI surfaces, wire formats, or signed-envelope shapes carry ≥ 90 days notice from the announcement to the effective date. Customer-side opt-out window is included.
  • Sub-processor additions (new third-parties touching customer data) carry ≥ 30 days notice (GDPR Art. 28(2) + customer DPA ). Customers can object to a specific sub-processor; if KYE™ cannot accommodate the objection, the customer's right to terminate is preserved.
  • Maintenance windows on customer-visible surfaces carry ≥ 7 days notice. Emergency maintenance for security incidents is announced immediately via the status page and customer security contact.
  • Every entry on this page is also represented in the machine-readable JSON at /change-calendar.json, schema kye.change_calendar.v1. Procurement scripts can ingest it directly.

3 · Related

Trust Centre

Current attestation state, machine-readable at /trust.json.

Sub-processor list

Canonical list of sub-processors, with DORA risk classification.

Historical changelog

Dated release notes — what already shipped.

Canonical KYE™ surfaces referenced on this page: Audit Pilot · Evidence Pack™ · KYE Protocol™.