From 86150d8717a426347ed677df75c7eca8a5d174ec Mon Sep 17 00:00:00 2001 From: Arkadiy Kukarkin Date: Wed, 30 Sep 2026 15:04:52 +0200 Subject: [PATCH] rfc: pilot offboarding via credible exit --- rfcs/2026-09-forge-instances.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/rfcs/2026-09-forge-instances.md b/rfcs/2026-09-forge-instances.md index b61d4c1..dd4ac89 100644 --- a/rfcs/2026-09-forge-instances.md +++ b/rfcs/2026-09-forge-instances.md @@ -148,7 +148,10 @@ production nodes as much as possible. Typically, we will need to quickly stand up a new pilot region within 72 hours, keep it running & meeting SLAs for 90 days, and decommission it after that. -We will _not_ offer data migration from pilot regions to production. +We will _not_ offer data migration from pilot regions to production. Customers who want to keep +their data can use the [credible exit export](2026-08-credible-exit-under-encryption.md): a +key-manifest CAR produced before decommission remains decryptable with the customer's key after the +pilot instance is gone. - **Update frequency:** Manually triggered updates. Typically once before the pilot starts and then when the customer requests new features or we need to fix bugs.