The supplier selling you control of your data: what it depends on, and for how many years
7 min read
If you have signed — or are about to sign — with a data platform supplier, you know how much notice you need to walk away. Almost nobody checks the other half of the same page: what the supplier itself depends on, until when, and what it writes about your contract when it has to address its own investors. If it is listed in the United States, that half is public, free and already written down — you only have to open it.
Take the most uncomfortable case, the one that most often ends up in European tender specifications. Palantir Technologies Inc. filed with the SEC its Form 10-Q for the quarter ended 30 June 2026. Everything that follows is filed — not told to a newspaper, not reported by third parties. No wrongdoing is in play here: what is in play is a reading method that works on any supplier at all.
The clause that protects you is, for the supplier, a declared risk
On termination the document is explicit twice over. In the revenue note: “the Company allows many of its customers to terminate contracts for convenience prior to the end of the stated term with less than twelve months’ notice”. And in the description of the business model: “Many of our customer contracts contain termination for convenience provisions.”
For the buyer that is a protection, and it should be said first: you leave without having to give reasons, at less than a year’s notice. Termination for convenience is exactly that — an exit that requires no breach, no dispute and no justification, only notice. For the seller it is a line item to be quantified for investors, and the filing quantifies it. Remaining performance obligations are defined there as “noncancelable contracted revenue that has not yet been recognized”, and as of 30 June 2026 they stand at $4.9 billion, of which 43% is expected within twelve months and 36% between the thirteenth and the thirty-sixth. A risk factor recalls that total remaining deal value, as of 31 December 2025, was $11.2 billion: the comparison between the two figures is ours, and it measures the space that termination for convenience leaves open.
On the other side, a commitment that cannot be cancelled
The reverse sits in the commitments note. In March 2026 the company amended one of its third-party cloud services agreements: “the Company has committed to spend at least $5.6 billion, with annual minimum commitments of $268 million to $979 million, over ten contract years through February 29, 2036”. Elsewhere the document calls such items “non-cancelable purchase commitments”; and should actual consumption fall short of the floor, “we may be required to pay certain penalties or fees”.
The shape is symmetrical and opposite: the customer leaves on less than twelve months’ notice, the supplier stays bound to a minimum spend through 2036. It is neither an anomaly nor a fault — it is the ordinary structure of a company that sells software on rented infrastructure — but that rigidity is what the flexibility granted to you rests on.
The same risk factor names who supplies that infrastructure: “AWS, Microsoft Azure, and other third parties have no obligation to renew their agreements with us on commercially reasonable terms, or at all.” Whoever sells you control of your own data is in turn buying its own continuity from somebody else, and puts it in writing. That is neither a secret nor a scandal: it is the ordinary arithmetic of any platform bought as a service, and it is legible months before a renewal falls due.
The scale, so nothing is misread
The filing reports $1.9 billion of revenue for the quarter, a 93% growth rate, and $3.6 billion for the half year. Revenue from government customers is $990.0 million for the quarter ($553.0 million a year earlier) and $1,848.4 million for the half year ($1,039.9 million), with government contribution at 71% and 72% respectively. The split: “In the six months ended June 30, 2026, 52% of our revenue came from government customers and 48% came from commercial customers.” On how customers are counted in this very filing we have already written in August.
Two lines worth a whole specification
The first detail sits in the note on credit risk concentration: “Customer I represented 27% and 25% of total accounts receivable as of June 30, 2026 and December 31, 2025, respectively.” A single customer, identified by a letter, accounts for more than a quarter of receivables; no other exceeds 10% of receivables, and no customer exceeds 10% of revenue. Which letter you are, the document will not tell you: it tells you that the letters exist.
The second sits in the risk factors on public contracts, where the company lists the rights government customers reserve and that commercial contracts do not carry: “claim rights in solutions, systems, or technology produced by us”, so as to keep using them without continuing to contract for the supplier’s services. It is the right every buyer would want and almost nobody negotiates: if your contract does not give it to you, at expiry you hand back the key together with the lock. The same list recalls that the US federal government may not exercise contract options more than one year in advance: a multi-year public contract is a row of years confirmed one at a time.
The method, applied to your own supplier
For each critical supplier, four lines.
- How much notice you need to leave, and what comes back to you: deposits, data, configurations. Write the number down rather than rely on an assurance given in a meeting.
- What the supplier depends on, and until when: infrastructure, licences, minimum spend commitments. If it is listed, this sits in a note to the quarterly report, a document that costs nothing to open.
- How much you weigh on it, and how much a single other customer weighs. A letter at 27% of receivables is a fact about its solidity, not about yours.
- What remains yours at expiry: rights in the work product, exportable formats, data readable without its software. An exit strategy never executed is a paragraph, as in an audit that took issue with that line.
It is the same register that the European financial regulator imposes on banks for critical ICT providers: not a check performed once at signature, but a line that is updated at every filing.
The two axes, applied to this case
Complying. The control we put into service is a living register of contractual and technical dependencies: for each critical supplier, the termination clause with the exact notice period, the multi-year commitments that bind it, the date of the last exit test, and the document each fact was taken from. Dated, versioned and inspectable, not an opinion filed away in a folder.
Deciding. The same installation holds contracts, plants, archives, management systems, sensors and documents together in a single operating model, on which AI agents execute decisions with an operator in command — for large companies, defence, public administration and healthcare. Inside your own perimeter: on-premise on self-contained machines that need no deep integration into your network, or a dedicated cloud with a data centre in Italy supervised by us, always with shared management. A model running inside your walls does not bring with it a minimum-commitment note running to 2036 signed by somebody else.
Could you say, for your most critical supplier, how much notice you need to leave and what that supplier itself depends on? Half an hour to write the first line of the register.
What we do not know
A 10-Q is a quarterly document written by one party: prepared for investors, on condensed accounts that are not audited. It measures outcomes and obligations, not the way work is done inside the company or inside its customers. Risk factors are, by definition, hypotheses declared by the issuer: what could happen, not what has happened. We do not know the contracts of individual customers, nor which of them carry the termination clause — the document says “many”, not all. We do not know the counterparty to the cloud agreement amended in March 2026: the filing names AWS and Microsoft Azure in a general risk factor on hosting, but attributes the $5.6 billion to neither. Nor do we know who “Customer I” is.