Commercial Proposal - Bettroi Ex-Integrity Platform

Commercial Proposal
Ex-Integrity Platform Development

ERP REF: SAL-QTN-2025-00038

PREPARED FOR

Bettroi BOS Engineering

bt.thomas@bettroi.com

www.bettroi.com

Date: December 2025

Total Investment

$135,441.00 USD

6 Months | 12 Sprints | 2 Phases

1. Executive Summary3

2. Scope of Work4

3. Deliverables5

4. Technology Stack & Architecture6

5. Project Plan & Milestones7

6. Commercials (Year-1)8

7. Client Responsibilities9

8. Division of Responsibilities9

9. Acceptance Criteria10

10. Data Privacy & Security10

11. Assumptions11

12. Change Control11

13. Warranty, IP, and Terms12

14. Service Order Confirmation – Letter of Intent12

1. Executive Summary

Development of Bettroi Ex-Integrity (EX-INT), a comprehensive enterprise-grade software platform for digitizing end-to-end explosion-protected asset integrity management across hazardous areas in oil and gas, petrochemicals, chemical processing, FPSO, terminals, pipelines, and power generation facilities.

The solution addresses critical industry needs for compliance with IEC 60079 series standards (60079-14, 60079-17, 60079-19) and regulatory requirements (IECEx, ATEX 2014/34/EU), providing full lifecycle management of Ex-rated equipment from installation through inspection, maintenance, and audit. The platform integrates risk-based inspection (RBI) methodologies adapted from API 580/581 with ISO 14224 reliability taxonomy to optimize inspection strategies while maintaining safety-critical operations in Zones 0/1/2 and 20/21/22 classified areas.

Key capabilities include multi-tenant asset hierarchy management with Ex marking parser and certificate validation, configurable inspection checklists mapped to IEC clauses, offline-first Android mobile application for ATEX/IECEx certified devices with advanced evidence capture (photo/video/audio with chain-of-custody hashing), intelligent RBI engine with dynamic risk scoring and interval optimization, bi-directional CMMS integration (SAP PM, IBM Maximo, Infor EAM), comprehensive reporting and analytics with compliance tracking, and immutable audit trails meeting ISO 27001 and IEC 62443-4-1 security standards.

Business Value Proposition
30% reduction in planned inspection hours through risk-based scheduling within 6 months
98% evidence compliance for severity A/B findings with automated chain of custody
95% offline sync success enabling continuous field operations in remote hazardous areas
Real-time regulatory compliance with automated certificate expiry tracking and SLA management
Zero critical security issues with enterprise-grade encryption, tamper resistance, and audit controls

The platform will be delivered in two phases: MVP (90 days) covering core multi-tenant infrastructure, asset register, offline mobile inspection capture, basic RBI, and SAP PM integration; followed by Phase 2 (90-120 days) adding advanced RBI with machine learning, route optimization, mobile annotation, webhooks, multilingual support, and external auditor portal.

This investment positions Bettroi as a leading provider of specialized Ex-asset integrity solutions for high-hazard industries, establishing a scalable SaaS platform capable of managing 1M+ assets across 10,000+ concurrent mobile sessions with 99.9% availability and sub-300ms API response times.

2. Scope of Work

In-scope

Multi-tenant Platform Core: Schema-per-tenant PostgreSQL architecture with tenant-aware middleware, per-tenant encryption keys (AWS KMS), tenant lifecycle management (suspend/export/purge), SAML 2.0/OIDC SSO with MFA (TOTP + device attestation), and granular RBAC with row-level security
Asset Management System: Hierarchical structure (Site→Area→Location→Zone→Equipment) with Ex marking string parser, IECEx/ATEX certificate validator, gas/dust group classification, T-class and IP rating tracking, parent/child assemblies, calibration scheduling, and comprehensive document vault with versioning
Inspection Management: Configurable checklists mapped to IEC 60079-17 clauses, support for Initial/Detailed/Close/Periodic/Visual/Sample inspections, defect taxonomy with A/B/C severity codes, multi-modal evidence capture (photo/video/audio/sketch/barcode/RFID), digital signatures with approval workflows, and bulk work-pack generation with route optimization
Risk-Based Inspection Engine: Configurable PoF/CoF weightings, 5×5 risk matrix with dynamic scoring, Bayesian updates from defect trends, automated interval recommendations with min/max guardrails, sampling percentage calculator, and dynamic backlog re-ranking by risk and access windows
Android Mobile Application (Offline-First): Native Kotlin app for ATEX/IECEx certified devices, encrypted SQLite with append-only event log, fast tag lookup via QR/Code-128/DataMatrix/RFID, camera capture with on-device annotation and redaction, voice-to-text notes, geofence and BLE beacon support, zone safety overlays, and conflict-resilient sync with vector clocks
CMMS/EAM Integration: Bi-directional adapters for SAP PM (OData), IBM Maximo (REST), and Infor EAM, automated work order creation from NCRs, attachment and labor actuals sync, webhook event subscriptions, retry policies, and rate limiting
Reporting & Analytics: Compliance dashboards (completion rates, overdue, defect density by zone), RBI analytics (risk distribution, interval shifts, cost vs. risk curves), productivity metrics (hours/asset, findings/shift, rework rate), automated certificate generation with QR codes and evidence index, scheduled exports (PDF/XLSX/CSV/JSON), and email delivery
Evidence & Document Vault: S3-compatible object storage with content hashing and chain of custody, certificate of conformity (CoC/ExTR) management, GA drawings and IOM storage with versioning, role-based retrieval, watermarking options, and 15-minute RPO backup strategy
Alerts & Workflow Automation: SLA timers for NCRs by severity, threshold alerts for overdue inspections and certificate expiry, multi-channel notifications (email, SMS via Twilio/MSG91, Teams/Slack integration), escalation ladders, and workflow state machines
Security & Compliance: TLS 1.2+ transport encryption, AES-256 at-rest encryption, OWASP MASVS mobile security, IEC 62443-4-1 SDLC practices, device jailbreak/root detection, AV scanning for uploads, EXIF scrubbing, immutable audit logs with before/after snapshots, and ISO 27001 controls
Deployment & DevOps: Kubernetes on AWS with auto-scaling, blue/green deployment strategy, CI/CD pipeline with SAST/DAST and SBOM, Terraform IaC, CloudFront CDN, WAF, OpenTelemetry observability, Prometheus/Grafana monitoring, ELK logging, and Sentry error tracking
Quality Assurance: ≥80% unit test coverage, API contract testing, Appium mobile UI automation, 4-week field UAT at pilot site with 2000+ assets, RBI backtesting against historical defects, performance testing for 10k concurrent sync bursts, and pen-testing before GA release

Out-of-scope

iOS Mobile Application: Native iOS app development deferred; read-only web access via mobile browser available as interim solution
Legacy Data Migration Services: Customer responsible for data extraction from existing systems; Bettroi provides CSV/XLSX import templates with validation but not hands-on migration execution
ATEX/IECEx Hardware Procurement: Customer acquires certified mobile devices; Bettroi tests on top 3 vendor models and provides compatibility matrix
Custom CMMS Connectors: Only SAP PM, IBM Maximo, and Infor EAM included; additional EAM systems quoted separately as change requests
On-Premises Deployment: Cloud-only (AWS); on-premises or private cloud deployment requires separate architecture and licensing discussion
Machine Learning Model Training: Phase 1 uses rule-based RBI; ML model training and tuning in Phase 2 requires minimum 6-month defect dataset from customer
Content Localization: English UI in Phase 1; AR/FR/HI/MY language packs in Phase 2 require professional translation services (not included)
OPC UA/MQTT IoT Integration: IoT sensor integration for condition monitoring marked as optional future enhancement, not part of base scope
Third-Party API Costs: Customer responsible for Twilio SMS credits, Google Maps API (if online maps enabled), and any other third-party service fees
Ongoing AWS Infrastructure Costs: Post-deployment hosting, bandwidth, and storage costs borne by customer as operational expenses
Post-Warranty Support & Enhancements: Support beyond 3-month warranty requires separate annual maintenance agreement

3. Deliverables

Phase 1 – MVP (90 Days)

Deliverable	Description
Web Application	React/Next.js responsive web portal for asset management, inspection planning, RBI configuration, reporting, and administration with SSO/MFA and RBAC
Android Mobile App	Native Kotlin offline-first inspection capture app with work-pack download, checklist execution, evidence capture, QR scanning, and sync for ATEX/IECEx devices
Backend Services	Modular monolith (Java/Kotlin or .NET 8) with Auth, Tenancy, Asset, Inspection, RBI, Evidence, Reporting, Notifications, Search, and Sync services
Database & Storage	PostgreSQL schema-per-tenant with sample data, S3-compatible object store for media, Redis cache, OpenSearch index
SAP PM Integration	One-way adapter to create work orders in SAP PM from approved NCRs via OData API
Basic RBI Engine	Static risk matrix (5×5) with configurable rules engine for interval setting based on equipment type, zone, and defect history
Reports & Dashboards	Completion rate, overdue list, defect summary by zone/severity, certificate expiry alerts; PDF export capability
Infrastructure	Kubernetes cluster on AWS with ALB, auto-scaling, CloudFront CDN, WAF, monitoring (Prometheus/Grafana), logging (ELK), Terraform IaC, CI/CD pipeline
Security Controls	TLS 1.2+, AES-256 encryption, KMS integration, immutable audit logs, device posture checks, AV scanning
Documentation	API reference (OpenAPI/Swagger), admin guide, mobile user guide, deployment runbook, data model ERD
Testing Artifacts	Unit test suite (≥80% coverage), API contract tests, mobile UI automation scripts (Appium), UAT test plan and results from pilot site

Phase 2 – Advanced Features (90-120 Days)

Deliverable	Description
Bi-directional CMMS	Two-way sync with SAP PM, Maximo, Infor EAM including work order closures, labor actuals, and attachments
Advanced RBI with ML	Bayesian network for PoF modeling, time-series analysis of defect trends, explainable AI "why" panel for recommendations
Route Optimization	Traveling salesman solver for multi-asset inspection routes with time windows and skill constraints
Mobile Enhancements	BLE beacon proximity detection, UHF RFID sled support, on-device image annotation and redaction tools
Webhook & Rules Engine	User-configurable event subscriptions and low-code rules builder for custom workflows
Multilingual UI	Language packs for AR/FR/HI/MY with right-to-left layout support and localized date/number formats
Scheduler & Subscriptions	Automated report generation and delivery via email/Teams/Slack on configurable schedules
External Auditor Portal	Read-only web interface with audit-specific tools, evidence hash verification, and filtered views for regulatory inspections
Enhanced Analytics	Interactive dashboard library with drill-downs, trend analysis, predictive maintenance indicators, cost-benefit analysis

Ongoing Deliverables

Bi-weekly Sprint Reviews: Demo of completed features with UAT feedback incorporation
Monthly Progress Reports: Burn-down charts, risk register updates, change log, upcoming milestones
Source Code Repository: Full access to GitLab/GitHub private repository with commit history and branching strategy
Knowledge Transfer: 3 dedicated sessions covering architecture, operations, and customization for client technical team
Warranty Support: 3 months post-deployment bug fix support with 2-business-day SLA for severity A issues

4. Technology Stack & Architecture

Frontend

Web Application: React 18 with Next.js 14 (App Router), TypeScript, Tailwind CSS, shadcn/ui components, React Query for state management, Recharts for data visualization
Progressive Web App: Service worker for offline asset registry lookup, IndexedDB for client-side caching

Mobile

Android: Kotlin native with Jetpack Compose, Room database (encrypted SQLite), WorkManager for background sync, CameraX for image capture, Ktor for HTTP client, Moshi for JSON parsing
Security: Android Keystore for encryption keys, SafetyNet Attestation API for device integrity, ProGuard obfuscation

Backend

Framework: Modular monolith architecture using Spring Boot 3 (Java 21) or .NET 8 (C#)
Services: Auth (OAuth2/SAML), Tenancy Manager, Asset Registry, Inspection Engine, RBI Calculator, Evidence Handler, Report Generator, CMMS Adapters, Notification Hub, Search Indexer, Sync Orchestrator
API: RESTful with OpenAPI 3.0 specification, GraphQL endpoint (optional) for complex queries, WebSocket for real-time updates

Data Layer

Primary Database: PostgreSQL 15+ with schema-per-tenant pattern, PostGIS for spatial data, pg_cron for scheduled jobs
Object Storage: AWS S3 or MinIO for media files, versioning enabled, lifecycle policies for archival
Cache: Redis 7+ for session management, rate limiting, and frequently accessed metadata
Search: OpenSearch (Elasticsearch fork) for full-text search on assets, findings, and documents
Time-Series (Optional): TimescaleDB extension for IoT sensor data if future OPC UA/MQTT integration enabled

Infrastructure

Cloud Provider: AWS (primary), multi-AZ deployment in selected region
Container Orchestration: Amazon EKS (Kubernetes 1.28+) with auto-scaling node groups
Load Balancing: Application Load Balancer (ALB) with TLS termination, NGINX ingress controller for path-based routing
CDN: CloudFront for static assets, edge caching for API responses in select endpoints
Security: AWS WAF with OWASP Core Rule Set, AWS Shield for DDoS protection, AWS Secrets Manager for credentials, KMS for encryption keys

DevOps & Observability

CI/CD: GitHub Actions or GitLab CI with automated testing, SAST (SonarQube), DAST (OWASP ZAP), SBOM generation (Syft), container scanning (Trivy)
Infrastructure as Code: Terraform for AWS resources, Helm charts for Kubernetes deployments, version-controlled and peer-reviewed
Monitoring: Prometheus for metrics collection, Grafana for visualization, alerting via PagerDuty/Opsgenie
Logging: ELK stack (Elasticsearch, Logstash, Kibana) or AWS CloudWatch Logs with structured JSON logging
Tracing: OpenTelemetry with Jaeger backend for distributed request tracing
Error Tracking: Sentry for backend and mobile error aggregation with release tracking

Integration Protocols

CMMS/EAM: OData v4 (SAP PM), REST APIs (Maximo, Infor EAM), webhook callbacks
Identity Providers: SAML 2.0, OIDC (OpenID Connect), LDAP/Active Directory
Messaging: SMTP (SendGrid/AWS SES), SMS (Twilio/MSG91), Microsoft Teams/Slack webhooks, optional WhatsApp Business API
Document Systems: Microsoft Graph API for SharePoint/OneDrive, AWS S3 API for object storage

Architecture Patterns

Multi-Tenancy: Schema-per-tenant for data isolation, tenant-aware middleware, per-tenant encryption keys
Offline Sync: Event sourcing with append-only log, vector clocks for conflict detection, CRDT (Conflict-free Replicated Data Types) for media sets, resumable uploads with chunking
Microservices (Modular Monolith): Domain-driven design with bounded contexts, clean architecture layers, eventual consistency via outbox pattern where applicable
Security: Zero-trust network model, principle of least privilege, defense in depth, immutable audit logs

5. Project Plan & Milestones

Phase 1 – MVP (90 Days | 6 Sprints)

Milestone	Key Deliverables	Duration
Sprint 0-1: Foundation (Weeks 1-3)	AWS infrastructure provisioning, CI/CD pipeline setup, development environment, tenant bootstrap, SSO/MFA implementation, RBAC framework, database schema design and migration scripts	3 weeks
Sprint 2: Asset Core (Weeks 4-5)	Asset hierarchy (Site/Area/Location/Zone/Equipment), Ex marking parser, certificate validator, search indexing, web UI for asset registry, bulk import tooling	2 weeks
Sprint 3: Inspection Engine (Weeks 6-7)	Checklist template builder, clause mapping to IEC 60079-17, inspection instance creation, finding capture, defect taxonomy, severity rules, digital signature workflow	2 weeks
Sprint 4: Mobile MVP (Weeks 8-10)	Android app with work-pack download, offline asset lookup, checklist execution, photo/video capture, QR scanner, encrypted local storage, sync foundation	3 weeks
Sprint 5: RBI & Reporting (Weeks 11-12)	5×5 risk matrix, static interval rules, risk calculator API, compliance dashboards, defect reports, overdue alerts, PDF generation, SAP PM work order push	2 weeks
Sprint 6: UAT & Hardening (Weeks 13-14)	Field UAT at pilot site (2000+ assets), bug fixes, performance optimization, security pen-test, documentation finalization, deployment to production	2 weeks

Phase 2 – Advanced Features (90-120 Days | 6-8 Sprints)

Milestone	Key Deliverables	Duration
Sprint 7-8: CMMS Bi-directional (Weeks 15-18)	Two-way sync for SAP PM/Maximo/Infor EAM, work order closure handling, labor actuals push, attachment sync, webhook event subscriptions, retry policies	4 weeks
Sprint 9-10: Advanced RBI (Weeks 19-22)	Bayesian PoF model, machine learning pipeline for defect prediction (requires 6-month historical data), time-series trending, explainable AI panel, RBI backtesting tool	4 weeks
Sprint 11: Route Optimization (Weeks 23-24)	Traveling salesman algorithm for inspection routes, geofence support, BLE beacon integration, route planner UI, mobile route navigation	2 weeks
Sprint 12: Mobile Enhancements (Weeks 25-26)	On-device image annotation and redaction, voice-to-text notes, UHF RFID sled driver, offline map tiles, improved conflict resolution UI	2 weeks
Sprint 13: Automation & Localization (Weeks 27-28)	Webhook hub, low-code rules builder, scheduled report generator, multilingual UI packs (AR/FR/HI/MY), right-to-left layout support	2 weeks
Sprint 14: Auditor Portal & Analytics (Weeks 29-30)	External auditor read-only portal, evidence hash verification, enhanced dashboard library with drill-downs, predictive maintenance indicators, cost-benefit calculator	2 weeks

Project Governance

Sprint Cadence: 2-week sprints with planning, daily standups, sprint review/demo, and retrospective
Stakeholder Reviews: Bi-weekly demos with product owner and key stakeholders for feedback and course correction
Monthly Steering: Executive status report covering progress, risks, budget, and upcoming milestones
Change Control: Formal change request process for scope additions; impact analysis on timeline and cost
Risk Management: Weekly risk register review; mitigation plans for high-priority risks

6. Commercials (Year-1)

Component	Description	Amount (USD)
Phase 1 – MVP Development	Foundation, asset management, inspection engine, offline mobile app, basic RBI, SAP PM integration, reporting, infrastructure, security, UAT (90 days, 6 sprints)	$79,500.00
Phase 2 – Advanced Features	Bi-directional CMMS, advanced RBI with ML, route optimization, mobile enhancements, webhooks, multilingual UI, auditor portal, enhanced analytics (90-120 days, 6-8 sprints)	$50,235.00
Project Management & QA	Sprint ceremonies, stakeholder coordination, risk management, comprehensive testing (unit, integration, performance, security), field UAT coordination, documentation	$5,706.00
TOTAL PROJECT INVESTMENT		$135,441.00

Payment Terms

Milestone
Trigger
Amount

Advance
Upon contract signing and project kickoff
$40,632.30 (30%)

Phase 1 Completion
Successful MVP deployment to production with UAT sign-off
$54,176.40 (40%)

Phase 2 Completion
Advanced features delivered and accepted, final documentation handover
$40,632.30 (30%)

Milestone	Trigger	Amount
Advance	Upon contract signing and project kickoff	$40,632.30 (30%)
Phase 1 Completion	Successful MVP deployment to production with UAT sign-off	$54,176.40 (40%)
Phase 2 Completion	Advanced features delivered and accepted, final documentation handover	$40,632.30 (30%)

Exclusions (Quoted Separately Upon Request)

AWS Infrastructure Costs: Customer responsible for ongoing EC2, RDS, S3, CloudFront, and data transfer charges (estimated $1,500-$3,500/month depending on scale)
Third-Party Services: Twilio/MSG91 SMS credits, Google Maps API usage, WhatsApp Business API, SendGrid/AWS SES email sending quotas
ATEX/IECEx Hardware: Customer procures certified mobile devices (Samsung Galaxy XCover, Zebra TC21-HC, or equivalent); Bettroi provides compatibility testing on top 3 models
Data Migration Services: Hands-on extraction and transformation of legacy data; CSV/XLSX import templates provided for self-service
Custom CMMS Connectors: Integration with EAM systems beyond SAP PM, Maximo, Infor EAM (e.g., Oracle EBS, JD Edwards)
On-Premises Deployment: Requires separate licensing, networking, and support model; cloud-first architecture may need refactoring
Professional Translation: Multilingual UI framework included; human translation of labels/help text to AR/FR/HI/MY languages billed separately
Extended Warranty Support: Post-3-month warranty support available via annual maintenance contract (15-20% of project value: $20,316-$27,088 annually)
Training & Change Management: End-user training workshops, train-the-trainer programs, and organizational change management consulting

Note: All amounts are exclusive of applicable GST/VAT/sales taxes which will be charged as per prevailing rates in the jurisdiction of service delivery.

7. Client Responsibilities

Subject Matter Expertise: Provide access to domain experts (Ex-inspection specialists, CMMS administrators, safety managers) for requirements clarification, user story validation, and UAT participation within 2 business days of request
Test Environment Access: Provide read/write access to non-production SAP PM, Maximo, or Infor EAM instances for integration development and testing with sample work orders and equipment master data
Sample Data: Supply representative asset register (minimum 500 equipment records with Ex markings), historical inspection findings (6-12 months), and certificate documents for RBI model tuning and testing
UAT Participation: Commit 3-5 field inspectors and 2 back-office users for 4-week pilot UAT cycle at designated site with 2000+ assets; provide feedback within 2 business days
ATEX Device Procurement: Acquire minimum 10 ATEX/IECEx certified Android devices (Samsung Galaxy XCover Pro or equivalent) for mobile app testing and deployment; ensure devices meet Android 10+ requirement
Network & Security: Whitelist Bettroi IP addresses for CMMS firewall rules, provide VPN access if required, and coordinate security reviews/pen-test scoping with InfoSec team
Timely Approvals: Review and approve sprint deliverables, design mockups, and change requests within agreed SLA (2 business days for standard items, 5 days for architecture decisions)
AWS Account Setup: Create dedicated AWS account with appropriate IAM policies for Bettroi deployment automation, or authorize Bettroi to set up infrastructure in client's AWS organization
Stakeholder Availability: Ensure product owner and key decision-makers attend bi-weekly sprint reviews and monthly steering committee meetings

8. Division of Responsibilities

Activity	Bettroi	Client
Requirements gathering & user stories	Facilitation, documentation	Domain expertise, validation
Software development (web, mobile, backend)	Design, implementation, testing	Feedback, UAT participation
AWS infrastructure provisioning	IaC scripts, deployment automation	Account access, billing authorization
CMMS integration development	Adapter coding, API calls	Test environment access, credentials
RBI model configuration	Algorithm, UI, API	PoF/CoF weightings, interval policies
Security & compliance	Technical controls, pen-testing	Policy definition, audit coordination
Data migration	Import templates, validation logic	Data extraction, cleansing, loading
User acceptance testing	Test case preparation, defect fixes	Tester allocation, scenario execution
Training & documentation	User guides, admin manuals, knowledge transfer	Coordination, internal distribution
Post-deployment support (3 months)	Bug fixes, hotfixes, monitoring	Issue reporting, log access
Ongoing operations (post-warranty)	Enhancements per change requests	Day-to-day administration, L1 support
AWS infrastructure costs	Optimization recommendations	Payment of monthly charges

9. Acceptance Criteria

Phase 1 MVP Acceptance

Functional Completeness: All Phase 1 user stories and acceptance criteria met as documented in sprint backlogs; core workflows (asset creation, inspection capture, NCR generation, work order push) demonstrated successfully
Offline Sync Reliability: ≥95% successful sync rate after 3 days offline operation with 100+ assets and 50+ inspections captured on mobile device
Performance: Web API p95 latency <300ms for asset search and inspection list; mobile asset lookup <200ms from encrypted local storage
Test Coverage: Unit test coverage ≥80% for backend services; API contract tests passing; mobile UI automation suite covering happy paths
UAT Sign-Off: Successful 4-week field pilot at designated site with 2000+ assets; ≥90% inspector satisfaction score; no open severity A/B defects
Security: Zero critical or high-severity findings from third-party penetration test; all OWASP Top 10 risks mitigated
Documentation: API reference (OpenAPI), admin guide, mobile user guide, deployment runbook, data model ERD delivered and reviewed
Deployment: Production environment provisioned on AWS with auto-scaling, monitoring, and backup policies; runbook validated through dry-run

Phase 2 Advanced Features Acceptance

CMMS Bi-directional Sync: Successful round-trip work order creation, status updates, and closures with SAP PM/Maximo/Infor EAM; attachment and labor actuals sync verified
RBI Accuracy: Advanced RBI model backtested against 6-12 months historical defect data; ≥80% accuracy in PoF prediction; explainable AI panel provides justification for interval recommendations
Route Optimization: TSP algorithm generates routes with ≤10% deviation from optimal path for 20-asset test case; mobile navigation UI validated by field inspectors
Multilingual Support: AR/FR/HI/MY language packs functional with correct translations, right-to-left layouts tested, date/number localization verified
Webhook Reliability: Event delivery >99% success rate with retry policy; low-code rules builder creates functional workflows without code deployment
Auditor Portal: External auditor can access read-only views, verify evidence hashes, and export audit-compliant reports without elevated privileges

Final Acceptance Gate

Client product owner formally signs off on all deliverables via written acceptance email or Change Control Board approval; final payment milestone triggered upon sign-off.

10. Data Privacy & Security

Security Controls

Encryption: TLS 1.2+ for data in transit; AES-256 for data at rest in database, object storage, and mobile local storage
Key Management: AWS KMS with per-tenant encryption keys; automatic rotation every 90 days; hardware-backed keys on mobile devices (Android Keystore)
Authentication: SAML 2.0/OIDC SSO with MFA (TOTP + device attestation); password policy enforcing 12+ characters with complexity; account lockout after 5 failed attempts
Authorization: Granular RBAC with verb-level permissions (create, read, update, delete, approve); row-level security enforcing tenant ID isolation in database queries
Mobile Security: OWASP MASVS Level 2 compliance; SafetyNet Attestation for device integrity; jailbreak/root detection with blocking; encrypted SQLite with hardware-backed keys; certificate pinning for API calls
Application Security: SAST (SonarQube) and DAST (OWASP ZAP) in CI/CD pipeline; dependency vulnerability scanning (Trivy, Dependabot); SBOM generation and audit
Network Security: AWS WAF with OWASP Core Rule Set; DDoS protection via AWS Shield; VPC with private subnets for database and backend services; security groups with least-privilege rules
Audit Logging: Immutable logs with timestamp, user ID, tenant ID, action, before/after state; 7-year retention in tamper-evident storage (S3 Object Lock)
Media Hygiene: Antivirus scanning on upload (ClamAV or AWS GuardDuty Malware Protection); content-type validation; EXIF metadata scrubbing policy; content hashing (SHA-256) for chain of custody

Data Privacy

Data Minimization: No PII collected except business contact data (inspector name, email, phone) required for audit trail and notifications
Tenant Isolation: Schema-per-tenant architecture with row-level security; tenant data cannot be accessed across boundaries even via SQL injection
Right to Erasure: Tenant purge API with complete data deletion including backups within 30 days of request; audit log entry preserved for compliance
Cross-Border Data: Data residency configurable per tenant; AWS region selection during tenant provisioning; no automatic cross-region replication
Subprocessors: Documented list of third-party services (AWS, Twilio, SendGrid) with data processing agreements in place

Compliance Standards

ISO 27001: Security controls aligned with Annex A requirements
IEC 62443-4-1: Secure development lifecycle practices including threat modeling, secure coding guidelines, and security testing
OWASP MASVS: Mobile Application Security Verification Standard Level 2 for Android app
SOC 2 Type II (Future): Infrastructure and processes designed to support SOC 2 audit post-launch

11. Assumptions

Specification Accuracy: Bettroi Ex-INT Specification v0.9 dated 2025-11-09 is the authoritative requirements document; any material deviations discovered during implementation will be managed via change control
Stakeholder Availability: Client product owner, SMEs, and UAT participants available within agreed response SLAs (2 business days for feedback, 5 days for architecture decisions)
CMMS Test Access: Client provides read/write access to non-production SAP PM, Maximo, or Infor EAM instances with sample data by Week 2 of project; API documentation and credentials supplied
AWS Account: Client authorizes Bettroi to provision infrastructure in client's AWS account OR provides dedicated AWS account with appropriate IAM policies by project kickoff
ATEX Device Availability: Client procures minimum 10 ATEX/IECEx certified Android devices (Android 10+) for testing by Week 6; top 3 vendor models (Samsung, Zebra, Honeywell) used for compatibility matrix
Data for RBI Tuning: Client supplies 6-12 months of historical inspection findings and defect data (500+ equipment records, 1000+ inspections) in CSV/XLSX format for Phase 2 ML model training
English First: All UI text, documentation, and training materials in English for Phase 1; multilingual packs (AR/FR/HI/MY) in Phase 2 require professional translation services (client responsibility or quoted separately)
Cloud-Only Deployment: Solution architected for AWS cloud; on-premises or hybrid deployment requires separate architecture evaluation and may incur additional costs
Standard CMMS APIs: SAP PM (OData v4), Maximo (REST), and Infor EAM (REST) use documented public APIs; custom APIs or legacy versions may require additional development effort
No Legacy Migration: Import templates provided for self-service data loading; hands-on extraction, transformation, and loading from legacy systems not included unless separately quoted
Internet Connectivity: Field inspectors have periodic cellular/Wi-Fi access for sync (minimum once every 3 days); 100% offline operation beyond 3 days may require sync architecture enhancements
Regulatory Stability: IEC 60079 series, IECEx, and ATEX standards remain stable during project; major regulatory changes may require scope adjustments
Third-Party Service Availability: AWS, Twilio, SendGrid, and other subprocessors maintain service levels; extended outages beyond SLAs may impact project timeline

12. Change Control

Change Request Process

Identification: Client or Bettroi team member identifies need for scope change (new feature, modified requirement, technical constraint, regulatory update)
Impact Analysis: Bettroi product manager and tech lead assess impact on:
- Timeline: Delay to milestones, additional sprints required
- Cost: Incremental effort in person-days, infrastructure changes
- Risk: Technical feasibility, dependencies on other features
- Quality: Test coverage, regression risk, performance impact
Proposal: Bettroi drafts Change Request document with description, justification, impact summary, revised timeline, incremental cost estimate
Review: Joint Change Control Board (CCB) meeting within 5 business days of CR submission; attendees include client product owner, Bettroi project manager, tech lead
Decision: CCB approves, rejects, or defers CR; approved CRs trigger contract amendment for material changes (>$10K or >2 weeks impact)
Execution: Approved CRs added to sprint backlog with priority; Bettroi updates project plan, budget tracking, and risk register

Change Categories

Clarifications: Minor requirement clarifications or bug fixes with no material impact on timeline/cost → Fast-tracked approval via email
Standard Changes: Small enhancements within existing epics (e.g., additional checklist field, new report column) → CCB review, may be absorbed or quoted as minor add-on
Major Changes: New features, significant rework, or architectural changes → Formal CR with contract amendment and revised SOW

Change Budget & Timeline

Contingency Reserve: 10% of project value ($13,544.10) reserved for approved change requests within scope definition (e.g., additional defect codes, extra CMMS field mappings)
Schedule Buffer: 2 weeks buffer included in Phase 2 timeline (90-120 days) to accommodate moderate scope changes without shifting final delivery date
Out-of-Scope CRs: Major changes beyond contingency require formal contract amendment with incremental budget approval and revised payment schedule

13. Warranty, Intellectual Property, and Terms

Warranty Period

Duration: 3 months from final deployment (Phase 2 completion) covering defects, bugs, and errors directly related to the original project scope
Coverage: Bug fixes, hotfixes, performance issues within specified acceptance criteria (API latency, sync success rate, offline capability)
SLA: Severity A (system down, data loss): 4-hour response, 1-business-day resolution target; Severity B (major function impaired): 1-business-day response, 3-business-day resolution
Exclusions: Issues caused by client modifications, third-party service outages, infrastructure misconfigurations, or scope additions post-deployment
Extended Support: Post-warranty maintenance contracts available at 15-20% of project value annually ($20,316-$27,088/year), including enhancements, version upgrades, and L2/L3 support

Intellectual Property

Custom Code Ownership: Upon receipt of final payment in full, Bettroi assigns complete ownership of project-specific source code, database schemas, and documentation to Client
Retained IP: Bettroi retains ownership of pre-existing frameworks, libraries, reusable components, and design patterns not specific to this project; Client receives perpetual, royalty-free license to use in this application
Open Source: Project utilizes open-source dependencies under permissive licenses (MIT, Apache 2.0, BSD); full SBOM provided with license compliance verification
Third-Party Tools: Client responsible for licensing costs of third-party commercial tools (e.g., monitoring platforms, AV engines) used in production environment

Confidentiality

NDA: Mutual non-disclosure agreement covering project specifications, business logic, pricing, and technical architecture; 5-year term post-project completion
Data Handling: Bettroi will not access production tenant data except for support tickets with explicit written authorization; all access logged and auditable

Limitation of Liability

Cap: Bettroi's aggregate liability limited to total fees paid under this agreement ($135,441.00)
Exclusions: No liability for indirect, consequential, or special damages including lost profits, business interruption, or data loss beyond 15-minute RPO backup strategy

Termination

Mutual Consent: Either party may terminate with 30 days written notice; Client pays for work completed pro-rata through end of current sprint
For Cause: Material breach with 15-day cure period; non-payment of invoices beyond 30 days constitutes material breach
Deliverables on Termination: Bettroi delivers all completed work, source code, and documentation in current state; Client pays for accepted milestones plus 50% of in-progress sprint

14. Service Order Confirmation – Letter of Intent

This proposal constitutes Bettroi's binding offer to deliver the Bettroi Ex-Integrity (EX-INT) platform as specified herein for the total investment of USD $135,441.00 over 6 months (180 days) in two phases.

Proposal Validity: This quotation is valid for 30 days from the date of issue (12 November 2025). Pricing, scope, and timeline are subject to revision after this period.

Acceptance: Client acceptance of this proposal via signed Letter of Intent or Purchase Order referencing SAL-QTN-2025-00038 constitutes agreement to all terms, scope, and commercials outlined in this document.

Project Commencement: Work begins upon receipt of signed LOI and 30% advance payment ($40,632.30). Kickoff meeting scheduled within 5 business days of payment receipt.

For Bettroi

_________________________

Name: __________________

Title: Project Director

Date: __________________

For Client (Bettroi BOS Engineering)