The system can run on our estate or yours. If it runs on yours, you hold the keys and we do not.
A working instance your team can operate without us, and the option to leave with your data intact.
Everything this line produces lands in the register, so the software can prove it later. The register is the contract between the service and the system.