Provenance-Grade Ingestion

Why Provenance-Grade Ingestion is priced the way it is

What the figure buys

The discipline applied to your ingestion path from the day it is installed forward: every dataset content-hashed at the door before anyone has looked at it, every later cleaning or resampling producing a new hash and a recorded lineage step, registration timestamps recording whether data arrived before or after the hypothesis it is being used to support, and a gap ledger in which missing sessions, backfilled ranges and vendor corrections are first-class events rather than silent patches. The burned-door ordering rail comes with it: a fetch that precedes its registration cannot be evidence for the hypothesis it was fetched for, caught at ingestion rather than discovered in an audit. The boundary is explicit — it records, it does not repair. It supplies no data, cleans nothing, improves no quality, and it cannot retrofit provenance onto files ingested before it was there.

Why it is priced this way

Charged by the year against the ingestion estate rather than per seat, because provenance is a property of the ingested record and not of the person reading it: the researcher, the risk function and the allocator all inherit the same ledger, whether the team is one person or a whole floor. The annual unit follows from what makes the record worth anything — a hash proves little on the day it is taken and a great deal years later, and the ledger is only as long as the discipline ran unbroken, so it is priced as a standing commitment rather than a one-off installation. The rate begins at a floor rather than a single flat figure because ingestion surfaces genuinely differ: the count of feeds, their formats, and how loudly a vendor announces its corrections all change the work, and none of that scales with headcount.

What the alternative costs

You can build this yourself, and you should hear that plainly: a content hash is a standard-library call, a timestamp is a timestamp, and a gap ledger is a table with an honest schema. Nothing here is exotic, and a team with the will to maintain it will get most of the way. What is actually being bought is the ordering discipline rather than the code — the hash taken before anyone looks, the registration filed before the fetch, the lineage step written for the quick fix you made to your own file at the end of a long day — because the failure mode is never a missing function, it is a gate satisfied by assertion, which is what my own Burned Door incident records. The free path already on hand, vendor checksums and your warehouse's audit columns, tells you a file transferred intact and when a row was written, which is worth having, but it does not record when the hypothesis was registered relative to the data, and it is generally written by the same process doing the cleaning; doing nothing costs nothing at all until someone with no stake in the answer asks whether the file you backtested is the file you ingested.

Every figure on this page is an anticipated indication awaiting ratification, and nothing here is purchasable. The reasoning above is published for the same reason the arithmetic below is: a price you can interrogate is worth more than a price you have to accept.