Enterprise Vendor Selection Without SaaS Lock-in
Specification Matrix
Core Engineering Requirements
- ›Mandate 100% source code repository ownership and escrow from Day 1 to eliminate vendor insolvency risks.
- ›Never accept proprietary telephony SDKs: insist on open standard SIP (RFC 3261) and SRTP protocols.
- ›Demand contractual data egress clauses ensuring complete unencrypted database exports within 24 hours of request.
- ›Verify that deployment scripts use open standard OCI containers that execute seamlessly on any Linux server.
1. The Three Golden Rules of Zero-Lockin Architecture
Vendor lock-in is rarely an accident; it is an intentional business model designed to increase customer switching costs. To protect corporate sovereignty, enterprise leaders must enforce three non-negotiable procurement rules: (1) 100% Source Code & Weights Ownership: every line of bespoke orchestration, prompt architecture, and fine-tuned LoRA weights must belong to the client's balance sheet from Day 1. (2) Open Protocols: all voice and data streams must adhere strictly to open standards (SIP RFC 3261, RTP RFC 3550, PostgreSQL, OpenTelemetry) rather than proprietary SDKs. (3) Portable Infrastructure: all workloads must be deployable via standard Docker Compose or Kubernetes manifests on bare-metal, Moroccan sovereign clouds, or private on-premise hardware.
# Zero-Lockin Portable Sovereign Telecom & AI Stack (docker-compose.yml)
version: '3.8'
services:
telephony-gateway:
image: ghcr.io/vext-ma/sip-gateway:latest
restart: unless-stopped
network_mode: host
environment:
- SIP_PORT=5060
- TLS_PORT=5061
- RTP_PORT_START=10000
- RTP_PORT_END=20000
volumes:
- ./config/sip.cfg:/etc/kamailio/kamailio.cfg:ro
- ./certs:/etc/ssl/sovereign:ro
inference-kernel:
image: ghcr.io/vext-ma/voice-kernel:latest
restart: unless-stopped
deploy:
resources:
reservations:
devices:
- capabilities: [gpu]
environment:
- MODEL_WEIGHTS_PATH=/models/darija-8b-quant
- MAX_CONCURRENT_CHANNELS=2502. The 100-Point Vendor Due Diligence Scoring Rubric
Before signing contracts with AI vendors or systems integrators, enterprise procurement committees should score proposals against a 100-point objectivity rubric. Proposals scoring below 80 points present high operational risk of vendor capture and uncontrolled compounding licensing overhead.
| Evaluation Dimension | Max Weight | Proprietary Cloud SaaS Wrapper | Vext Open Sovereign Architecture | Audit Method |
|---|---|---|---|---|
| Source Code & Weights Ownership | 25 pts | 0 pts (Blackbox API access only) | 25 pts (Full git transfer & escrow) | Contractual IP assignment clause |
| Open Standards Telephony (SIP/RTP) | 25 pts | 5 pts (Proprietary JavaScript SDK) | 25 pts (RFC 3261 standard carrier trunks) | Packet inspection & SDP capture |
| Data Sovereignty (CNDP Law 09-08) | 20 pts | 5 pts (Foreign US cloud hosting) | 20 pts (100% Moroccan Tier-III DC) | Physical hosting certificate review |
| Financial Predictability (Zero Per-Min Fees) | 15 pts | 3 pts (Explosive per-minute meter) | 15 pts (Fixed sprint + fixed server cost) | Contract pricing schedule audit |
| Dialectal Accuracy (Darija/French) | 15 pts | 6 pts (Generic Arabic translated) | 15 pts (Native code-switched Darija ASR) | Real benchmark audio test suite |
3. Contractual Red Flags & Mandatory Exit Clauses
Before signing any agreement with a voice AI or automation vendor, the legal and IT department must review the contract against three critical red flags: Flag 1: Data Egress Penalties or proprietary database formats that prevent clean extraction. Demand an explicit clause stating: "Vendor shall provide full database dumps in open SQL format within 24 hours of notice at zero cost." Flag 2: Model Fine-Tuning Retransfer Restrictions. Ensure that all dialect datasets and fine-tuning checkpoints remain the exclusive intellectual property of the client. Flag 3: Automatic annual renewal clauses with uncapped per-minute price escalations.
4. The Self-Hosting & Maintenance Transition Roadmap
A true engineering partnership aims for customer empowerment rather than permanent dependence. Vext delivers a structured 4-phase handover roadmap: Phase 1: Joint production deployment with paired DevOps training. Phase 2: Delivery of exhaustive Architecture Decision Records (ADRs) and step-by-step disaster recovery runbooks. Phase 3: Shadow operations where internal enterprise IT manages daily maintenance with Vext providing Level-3 escalation. Phase 4: Full operational autonomy where the client manages the stack completely on their own infrastructure.
Specification FAQ
Need technical guidance on this specification?
Speak directly with our systems engineers in Casablanca.