Round one was the surface scan — you answered all fourteen. Thank you. This page is the deep dive: we play back what we heard, confirm the parts we think we understood, and open three commercial questions we could not ask before we saw your stack. Same rules as round one: status is saved locally, nothing sent anywhere until you submit.
V1 · 14/14
You told us: MQ Series via QGC1 (CBITAMERICA) · mTLS with keystore + CCDT staged · CB + BS in V1 (CX reserved) · Option B (we host) · Azure today · 99.9% target · 7-year encrypted retention · paper-based PoA · filer code TBD. Everything below either verifies a statement or resolves an open item. See round-one answers.
Round 20% · 0 / 14 answered
Confirmation
Did we hear you right?
5 items · verify v1
V1 · Transport stack summary
We understood: MQ via QGC1 + mTLS + 7-year retention + we host. All correct?
Before we wire pymqi against cbpgw-trade-cert.cbp.dhs.gov:31531, we want to make sure we're not building against a stale picture. If anything shifted on your side since round one, we'd rather know now.
CB + BS only in V1, CX reserved for V2 — confirmed?
CB (create bond) and BS (status notifications) give the broker a complete operational loop. CX (update) is rarer and adds a second output path. Locking this in lets us freeze the V1 surface.
CB + BS in V1, CX reserved
V3 · Hosting residency
Option B: we host on Hetzner (EU). Acceptable, or must we replicate to Azure?
Hetzner eu-central-1 is our default. If your customer contracts or internal policy require Azure (any region), we'd spin up a mirror — adds ~1 week + hosting cost. Pure EU-resident data on Hetzner is cheapest; an Azure replica is a sales-gate question.
Azure on your side
V4 · SLA commitment level
99.9% uptime — signed, best-effort, or still negotiable?
99.9% during CBP filing windows is a sensible floor. A signed SLA with credit language is a different engineering posture (runbooks, pager rotation, status page) than best-effort. We can hit both; pricing differs.
99.9% target
V5 · Power-of-Attorney flow
Paper-based PoA — we scan + archive, or does CBP require a digital-signature path?
You said paper. We're happy to build a "scan → S3 + metadata in filing header" pipeline. But if CBP (or a specific broker customer) mandates DocuSign / Adobe Sign with chain-of-custody, we'd set that up instead — different compliance profile.
Paper-based PoA
Technical · next
The first three integration moves.
3 items
T1 · Keystore + CCDT handoff
How do you want to hand us the keystore + CCDT — SFTP, PGP-email, Box, or something else?
We need the JKS/PKCS12 keystore + CCDT JSON to finalise the pymqi connect. All four channels work for us; we default to PGP-armored email into a dedicated mailbox with 30-day auto-shred, but we'll match whatever your security desk prefers.
T2 · Filer code timeline
Filer code — reactivate an existing one, or apply fresh?
Reactivation of a dormant filer code typically takes days, not weeks. A new CBP application is the 4-week path (forms 5106/5291 + certification). If the code is unknown or lost, we default to "apply fresh" and plan around it.
T3 · FIPS level for retention
Seven-year retention — FIPS 140-2/3 required, or is AES-256 on disk sufficient?
FIPS-validated crypto modules (e.g. AWS KMS with FIPS endpoints, Azure Managed HSM) cost more and narrow our infra choices. Standard AES-256 disk encryption on Hetzner is cheaper and covers most broker contracts. Customer-contractual question.
Scope
What we build around the loop.
3 items
SC1 · Test payload
Can you share an anonymised historical CB + its CBP response for byte-exact roundtrip?
We parse your real CB, regenerate it from our code, and diff. Finds spec drift in minutes. Anonymisation fine — mask importer EIN, bond-principal name, reference IDs. What we need is the structure.
SC2 · Post-CB+BS priority
After CB + BS lands — which module is next?
Drives our corpus ingestion queue and Builder-agent priority. Entry Summary is the largest addressable market (~40% of filings). PGA modules depend on your commodity mix (NHTSA for auto, FDA for food/pharma).
SC3 · Communication direction
How does your Azure stack call our system?
We're equally happy with all four. REST-POST is the fastest to ship (OpenAPI + auth header). MQ-to-MQ means your Azure MQ writes into our MQ — tight coupling but lowest latency. An SDK library means we ship a Python/.NET package you embed.
Commercial
The envelope around the code.
3 items
CM1 · Retainer model
How should we bill — per call, per filing-type, monthly flat, or hybrid?
Per-call (e.g. 12¢ benchmark) scales linearly with volume — great for brokers with swings. Per filing-type is a subscription per module (CB, CX, Entry Summary, PGA-FDA, …). Monthly flat is predictable P&L. Hybrid = base + overage is often the easiest sell.
CM2 · Pricing floor
Is 12¢/call a hard floor, or negotiable on volume?
A volume break (e.g. 12¢ <1M/mo, 8¢ 1-10M/mo, 5¢ beyond) moves the sales conversation dramatically. A hard floor is simpler to defend but caps the biggest brokers. We're flexible — your call.
CM3 · Kickoff
Kickoff meeting date + who from your team is on the call?
So we put the right engineers in the room (MQ / keystore / CBP side on ours). A 60-min slot is plenty for round three: we bring a demo CB packet, you bring the technical lead + commercial sign-off.