CCATAIR/ prep Roadmap Deep Dive · Round 2 → Pre-meeting · confidential
✓ Round 1 complete · 14/14 answered
This is the round you already completed. Answers are logged. Round 2 (Deep Dive) has 14 new questions that follow up on your Round 1 answers — keystore handoff, filer-code timeline, FIPS level, pricing, kickoff date.
Start Round 2 →
Investor readiness

Fourteen technical inputs to clear in advance.

If you already hold a CBP filer code, sandbox access, and a transport channel, we collapse the 60-90-day bureaucratic path to pure software integration. This page is your self-assessment — tag each item Have / Partial / Need help so we can walk in aligned. Your answers save locally — nothing is sent anywhere until we talk.

Readiness0% · 0 / 14 answered
Critical

Without these, we can't start.

4 items
C1 · Transport
Which channel do you use to talk to ACE — MQ Series or AS2/HTTPS?
Drives the client library we wire. pymqi for MQ, httpx + cryptography for AS2. Both are implemented as stubs on our side; we just need to flip the right one on.
C2 · Sandbox endpoint + credentials
Can you hand us the sandbox endpoint and a credential reference today?
MQ queue names + connect string, or AS2 URL + partner certificate. No secrets needed in this doc — just confirmation that they exist and are current. We pull from your secret store at integration time.
C3 · Filer Code
Do you have the 3-character CBP-issued Filer Code, and is it active?
Goes into every batch header (A-Record, position 3-5). Without it we can't wrap a valid transmission. Dormant codes may have been deactivated — we'll need to re-certify.
C4 · Authentication scheme
How does CBP authenticate you today — API key, x509 cert, CBP-issued token?
Determines whether we rotate a static secret, perform a mutual-TLS handshake per transmission, or fetch a short-lived token. All are implementable — we just need to know which.
Scope

Shape of the first 7-day sprint.

4 items
S1 · Day-1 transactions
Which eBond transactions do we ship first — CB, CX, BS, or all three?
CB = new bond create. CX = update. BS = incoming status notification parsing. Our code already supports reading all BS variants; CB / CX are output-side. Most common V1 is CB + BS.
S2 · Runtime hosting
Does the filer engine run on your infrastructure or ours?
Option A — SDK + Docker image on your side: you keep credentials and data in your VPC, we ship upgrades. Option B — hosted REST on ours: you POST JSON, we handle everything, credentials live in our vault. Both work; choice drives the compliance conversation.
S3 · Known-good test payload
Can you share one anonymised historical bond submission + its CBP response?
Byte-exact roundtrip validation: we parse your real submission, regenerate it from our code, and diff against the original. Finds any spec-drift in minutes. Anonymisation fine (masked importer EIN, etc.) — structure is what we need.
S4 · Next modules after eBond
What comes after eBond — Entry Summary, 5106, Daily Statement, PGA?
So we prioritise our corpus ingestion and the Builder-agent queue. Entry Summary is the largest module (~40% of filings); 5106 is small but a dependency for most entries; PGA (TTB/EPA/FDA/APHIS) depends on your commodity mix.
Operational

How we run this together.

6 items
O1 · Hosting preference + region
Cloud and data-residency preferences?
We run on Hetzner (eu-central) today. If you need AWS / Azure / GCP or US-only residency, we'll set up accordingly. No engineering blocker, just timing.
O2 · Compliance baseline
SOC2 / ISO 27001 / customer-contractual — what must be true on day one?
SOC2 Type II is a 6-month observation minimum; Type I we can execute in ~8 weeks. If a broker customer demands it upfront, that's a sales gate — we plan it in.
O3 · SLA / uptime
What uptime and response-time guarantees will the first broker want?
CBP filing windows are day-time + Saturday morning (US). Uptime target of 99.9% during that window is reasonable; 99.99% is possible but adds cost. Response-time for POST /filings/ebond/cb — we aim for <2s end-to-end (ours + CBP).
O4 · Audit-log retention
How long do we retain filing records (for your + CBP's audit)?
CBP regulations require 5 years. Brokers sometimes go 7 for contractual reasons. Our audit log is append-only SQLite + JSONL; retention policy drives storage but nothing else.
O5 · Power-of-Attorney flow
How does the Importer's Power of Attorney reach you — digital, API, paper?
Our system doesn't handle the PoA itself — that's legal paperwork between broker and importer. But if you need the PoA ID in the filing metadata (some do), we capture it. Just good to know the flow.
O6 · First broker — warm intro this week?
Can we meet the first real broker (or their ops lead) within 7 days?
So we design the REST shape around their actual JSON. A broker's day-1 payload shape is predictable from their CRM — saves two weeks of integration theatre.

Bring any Partial or Need help items to the call.

We don't need all fourteen answered before we meet — we need to know which ones are open, so the call becomes a working session instead of a discovery session. Open questions are fuel for a tighter plan, not a setback.

Demo · catair.atwenture.com · Pitch · catair.atwenture.com/pitch · Contact · j.wenk@mobilityacademy.de