---
title: "KYE Protocol™ — Change Calendar · forward-looking customer change notices"
description: "KYE Protocol™ forward-looking change calendar — planned breaking changes, scheduled maintenance, sub-processor change notices, policy revisions. Minimum-notice policy locked."
url: https://kyeprotocol.com/change-calendar/
lang: en
source: "KYE Protocol"
---

> KYE Protocol™ forward-looking change calendar — planned breaking changes, scheduled maintenance, sub-processor change notices, policy revisions. Minimum-notice policy locked.

Change Calendar · forward-looking

# Every planned change — announced before it lands.

Tier-1 procurement teams need to plan their own change-management cycles. We publish ours: every breaking change, sub-processor addition, maintenance window, and policy revision — with the announce-date and effective-date, before they take effect. The minimum-notice policy is locked.

[Trust Centre](https://kyeprotocol.com/trust/) [Historical changelog](https://kyeprotocol.com/changelog/)

### 90 days

minimum notice for breaking changes to APIs, schemas, or wire formats

### 30 days

minimum notice before any new sub-processor begins processing customer data (GDPR Art. 28(2))

### 7 days

minimum notice for planned maintenance touching customer-visible surfaces

1 · Upcoming scheduled changes

## Every entry has an announce-date and an effective-date.

Procurement scripts: `curl -s https://kyeprotocol.com/change-calendar.json | jq '.entries[] | select(.status == "scheduled")'`. Schema: `kye.change_calendar.v1`.

feature launch

scheduled

### Pilot 1 onboarding window opens (tier-1 banks)

Audit Pilot™ engagements open for tier-1 global bank pilots. Pilot scope is shadow-mode AI-agent governance against a published baseline; outputs are 30-day evidence packs.

**Announced** 2026-05-20 · **Effective** 2026-06-15 · **Scope** tier-1 pilots · **Customer action** not required · [Apply for pilot](https://kyeprotocol.com/pilot-apply/)

feature launch

scheduled

### EU data-residency router — operational verification (per-tenant)

Gateway data-residency middleware ships — operational per-tenant verification rolls out to EU tenants. Default-deny if region tag missing.

**Announced** 2026-05-20 · **Effective** 2026-07-01 · **Scope** EU tenants · **Customer action** not required · [EU AI Act mapping](https://kyeprotocol.com/frameworks/eu-ai-act/)

feature launch

scheduled

### Production HSM provisioning for BYOK signing keys

Production HSM-backed signing keys (@kye/byok) provisioned by operator. Replay-Proof™ envelopes verifiable from operator-rooted public keys alone.

**Announced** 2026-05-20 · **Effective** 2026-09-30 · **Scope** all tenants · **Customer action** not required

policy revision

scheduled

### SOC 2 Type II auditor engagement (SSAE 18)

SSAE 18 auditor engagement begins for SOC 2 Type II attestation. Control mapping is already shipped. Expected report delivery 3-6 months from engagement start.

**Announced** 2026-05-20 · **Effective** 2026-11-30 · **Scope** all tenants · **Customer action** not required · [Trust Centre](https://kyeprotocol.com/trust/)

policy revision

scheduled

### ISO/IEC 27001 external audit engagement

External audit engagement for ISO/IEC 27001 certification. SoA (Statement of Applicability) shipped. Expected certification 2-4 months from engagement start.

**Announced** 2026-05-20 · **Effective** 2026-09-30 · **Scope** all tenants · **Customer action** not required · [Trust Centre](https://kyeprotocol.com/trust/)

policy revision

scheduled

### External penetration test (Q2/Q3 2026)

Threat-led penetration test engagement, ~2-4 weeks. Report becomes available to tier-1 pilot customers under NDA + published Trust Centre status update.

**Announced** 2026-05-20 · **Effective** 2026-08-15 · **Scope** all tenants · **Customer action** not required

feature launch

scheduled

### v1.1 profile preview (additive only — no breaking changes to v1.0)

v1.1 introduces additional rule-pack + sector-pack additions on top of the 10 canonical profiles locked in v1.0. v1.135 conformance fixtures remain bit-for-bit stable.

**Announced** 2026-05-20 · **Effective** 2026-09-15 · **Scope** all tenants · **Customer action** not required · [Historical changelog](https://kyeprotocol.com/changelog/)

2 · Notice policy

## The policy is locked. Notice windows are minimum-floors, not targets.

- **Breaking changes** to published APIs, JSON Schemas, OpenAPI surfaces, wire formats, or signed-envelope shapes carry **≥ 90 days** notice from the announcement to the effective date. Customer-side opt-out window is included.
- **Sub-processor additions** (new third-parties touching customer data) carry **≥ 30 days** notice (GDPR Art. 28(2) + customer DPA ). Customers can object to a specific sub-processor; if KYE™ cannot accommodate the objection, the customer's right to terminate is preserved.
- **Maintenance windows** on customer-visible surfaces carry **≥ 7 days** notice. Emergency maintenance for security incidents is announced immediately via the status page and customer security contact.
- Every entry on this page is also represented in the machine-readable JSON at `/change-calendar.json`, schema `kye.change_calendar.v1`. Procurement scripts can ingest it directly.

3 · Related

## Where this fits in the procurement bundle.

[Trust Centre Current attestation state, machine-readable at `/trust.json`.](https://kyeprotocol.com/trust/) [Sub-processor list Canonical list of sub-processors, with DORA risk classification.](https://kyeprotocol.com/legal/sub-processors/) [Historical changelog Dated release notes — what already shipped.](https://kyeprotocol.com/changelog/)

Canonical KYE™ surfaces referenced on this page: [Audit Pilot](https://kyeprotocol.com/auditors/) · [Evidence Pack™](https://kyeprotocol.com/evidence-pack/) · [KYE Protocol™](https://kyeprotocol.com/).