1. Custos™ DSPM Core Foundation (Mandatory Platform Prerequisite)
Baseline platform engine: multi-cloud and on-prem database discovery (Oracle RAC, MSSQL AlwaysOn, Postgres, MySQL, S3/MinIO lakes), autonomous regex/Luhn classification, lineage mapping, and SIEM/SOAR integration.
Mandatory Foundation Architecture: Every deployment requires an active Custos™ DSPM Core license scoped to monitored datastore volume (25 TB, 50 TB, or 100 TB). Modules 01 through 04 cannot be purchased or activated standalone; they attach as add-on capability licenses to an active Core baseline.
| Core Tier (Monitored Scope) | Annual Customer MSRP | Partner Transfer (Wholesale 32%) | Partner Annual Profit (32%) | 3-Yr Upfront (15% Cust Discount • 32% Partner Profit) |
|---|---|---|---|---|
|
Core 25 TB Baseline Up to 25 TB Monitored (Minimum Entry Scope) |
R 950,000 / yr $ 52,000 USD |
R 646,000 / yr $ 35,360 USD |
R 304,000 / yr $ 16,640 USD |
Cust: R 2,422,500 (15% OFF) Partner Profit: R 775,200 Paid upfront ($42.4k USD) |
|
Core 50 TB Enterprise Up to 50 TB Monitored |
R 1,650,000 / yr $ 89,000 USD |
R 1,122,000 / yr $ 60,520 USD |
R 528,000 / yr $ 28,480 USD |
Cust: R 4,207,500 (15% OFF) Partner Profit: R 1,346,400 Paid upfront ($72.6k USD) |
|
Core 100 TB Hyperscale Up to 100 TB Monitored |
R 2,850,000 / yr $ 154,000 USD |
R 1,938,000 / yr $ 104,720 USD |
R 912,000 / yr $ 49,280 USD |
Cust: R 7,267,500 (15% OFF) Partner Profit: R 2,325,600 Paid upfront ($125.6k USD) |
|
Petabyte Increment Per additional 50 TB increment |
+ R 750,000 / yr + $ 40,000 USD |
+ R 510,000 / yr + $ 27,200 USD |
+ R 240,000 / yr + $ 12,800 USD |
+ R 1,912,500 (15% OFF) Partner Profit: + R 612,000 Paid upfront (+ $32.6k USD) |
1B. Numbered Modular Add-On Packs (Attach to Active Core)
Attachable enterprise capabilities. Partners earn the full 32% margin across all add-ons and renewals.
| # | Modular Add-On | Key Capabilities Included | Annual Add-On MSRP | Partner Transfer (32%) | Partner Profit (32%) |
|---|---|---|---|---|---|
| 01 |
Custos™ Guard & Cryptographic Provenance Universal AI LLM Reverse Proxy |
Sub-5ms proxy for Gemini, Claude, GPT-4o, and on-premises vLLM/Ollama clusters. Bidirectional PII tokenization & SHA-256 model audit ledger. |
+ R 280,000 / yr $15,000 USD |
+ R 190,400 / yr | + R 89,600 / yr |
| 02 |
Governance & Privacy Automation Pack DSAR & Section 24 Automation |
Automated subject access discovery, POPIA Section 24 right-to-erasure certificates, and Redundant/Obsolete/Trivial (ROT) storage reclamation. |
+ R 260,000 / yr $14,000 USD |
+ R 176,800 / yr | + R 83,200 / yr |
| 03 |
Active Defense & SecOps Pack Quarantine Vault & Canaries |
Automated permission-restricted quarantine vault isolation, forensic memory hashing, and Luhn-compliant HoneyData canary tripwires. |
+ R 220,000 / yr $12,000 USD |
+ R 149,600 / yr | + R 70,400 / yr |
| 04 |
Enterprise AI Governance Pack RAG ACL & Injection Shield |
Vector database ACL entitlement filtering, real-time prompt injection & jailbreak shield, and unapproved shadow AI network socket detection. |
+ R 280,000 / yr $15,000 USD |
+ R 190,400 / yr | + R 89,600 / yr |
| ★ Bundled Modular Pack (All 4 Add-Ons Combined • Save 25%) |
+ R 780,000 / yr Save R 260k / yr |
+ R 530,400 / yr | + R 249,600 / yr | ||
|
★ The Complete Sovereign Suite (Core 25 TB + All 4 Modules) Turnkey flagship enterprise package. A-la-carte MSRP is R 1,990,000 / yr. |
R 1,590,000 / yr Save R 400k / yr |
R 1,081,200 / yr | R 508,800 / yr | ||
⚡ Advanced Enterprise Moat Modules
1B.2 Strategic Enterprise Add-Ons (High-Margin Moat Modules)
Decisive technical capabilities setting Custos apart from US cloud DSPMs. Partners earn standard 32% upfront margin on all modules.
| # | Strategic Module | Key Capabilities Included | Annual Add-On MSRP | Partner Transfer (68%) | Partner Profit (32%) |
|---|---|---|---|---|---|
| 06 |
Custos SovereignFence™ Kernel eBPF WAN Cross-Border Blocker |
Sub-microsecond active kernel packet inspection. Enforces sovereign geofencing and drops illegal cross-border WAN egress of citizen identifiers. |
+ R 520,000 / yr $28,000 USD |
+ R 353,600 / yr | + R 166,400 / yr |
| 07 |
Custos Synth™ Differential Privacy Test Cloner |
Mathematical ε-differential privacy database cloner for QA/Dev. Preserves foreign key referential integrity with zero real citizen records. |
+ R 440,000 / yr $24,000 USD |
+ R 299,200 / yr | + R 140,800 / yr |
| 08 |
Custos BlastRadius™ Zero-Trust Identity Graph Simulator |
Graph-based privilege path traversal. Calculates exact dollar and statutory fine liability ($ / ZAR) for compromised DBA or service account credentials. |
+ R 400,000 / yr $22,000 USD |
+ R 272,000 / yr | + R 128,000 / yr |
| 09 |
Custos AgentShield™ Autonomous AI & Tool-Calling Governor |
Secures Microsoft Copilot Studio, LangChain, AutoGen, and MCP agents. Sanitizes tool arguments, bounds queries, blocks prompt injection mutations, and prevents indirect SharePoint document leaks. |
+ R 480,000 / yr $26,000 USD |
+ R 326,400 / yr | + R 153,600 / yr |
| 10 |
Custos CleanRoom™ Ephemeral M&A Data Risk Auditor |
Zero-install ephemeral audit container. Generates board-ready M&A due diligence dossiers, statutory liability calculations, and escrow indemnity holdback figures. |
+ R 330,000 / yr $18,000 USD (Unlimited) |
+ R 224,400 / yr | + R 105,600 / yr |
| 11 |
Custos WireShield™ Zero-Touch SQL Virtual Masking Engine |
In-stream SQL result masking across PostgreSQL, MSSQL, Oracle. Solves database remediation instantly without schema changes or breaking legacy applications. |
+ R 620,000 / yr $33,500 USD |
+ R 421,600 / yr | + R 198,400 / yr |
| 12 |
Custos VectorGuard™ Neural DLP & Vector DB / RAG Firewall |
Pre-embedding PII sanitizer and semantic retrieval entitlement firewall for Pinecone, Milvus, pgvector, and Microsoft Copilot RAG flows. |
+ R 540,000 / yr $29,000 USD |
+ R 367,200 / yr | + R 172,800 / yr |
| 13 |
Custos SafeHarbor™ Cryptographic CISO Legal Defense Ledger |
Ed25519-signed Merkle Tree proof of continuous technical due diligence. Generates court-admissible Statutory Safe Harbor Dossiers under POPIA Sec 107. |
+ R 420,000 / yr $22,500 USD |
+ R 285,600 / yr | + R 134,400 / yr |
| ★ |
Strategic Moat Bundle (Save 30%) All 5 Next-Gen Strategic Modules |
Complete package: SovereignFence + Synth + BlastRadius + AgentShield + CleanRoom. Maximum enterprise capability at 30% bundle discount. |
+ R 1,520,000 / yr $82,000 USD (Save R 650k) |
+ R 1,033,600 / yr | + R 486,400 / yr |
🏛️ Tier-1 Banking & Interbank Moat Modules
1B.3 Core Banking, ISO 20022 & Quantum Moat Modules (Modules 16–20)
Mission-critical modules engineered for central banks, tier-1 financial institutions, and interbank payment networks. Partners retain standard 32% upfront margin on all modules.
| # | Banking Module | Key Capabilities Included | Annual Add-On MSRP | Partner Transfer (68%) | Partner Profit (32%) |
|---|---|---|---|---|---|
| 16 |
Custos AgentFence™ Autonomous AI Agent Execution Firewall |
7-layer tool-calling policy gate. Enforces strict schema contracts, indirect prompt injection defense, rolling velocity limits, and SARB >R50k dual-control HMAC multi-sig. |
+ R 580,000 / yr $31,000 USD |
+ R 394,400 / yr | + R 185,600 / yr |
| 17 |
Custos WireRemit™ ISO 20022 XML Streaming Sanctions Governor |
Zero-allocation streaming parser for pacs.008, pain.001, camt.053. Reconciles CtrlSum header balances, in-flight PII/IBAN tokenization, and screens OFAC/UN/FIC watchlists (126µs latency). |
+ R 650,000 / yr $35,000 USD |
+ R 442,000 / yr | + R 208,000 / yr |
| 18 |
Custos QuantumRadar™ Post-Quantum Discovery & CBOM Engine |
Scans TLS, database columns, and VPN pipes for RSA/ECC. Exports CycloneDX 1.6 Cryptographic Bill of Materials (CBOM) and generates NIST FIPS 203/204 PQC migration roadmaps. |
+ R 480,000 / yr $26,000 USD |
+ R 326,400 / yr | + R 153,600 / yr |
| 19 |
Custos QueryShield™ Zero-Schema Wire-Level SQL Rewriter |
Intercepts database wire queries (Postgres, Oracle, MySQL, MSSQL) and dynamically injects native projection masks before execution. Blocks binary-search WHERE clause side-channels (<50µs). |
+ R 560,000 / yr $30,000 USD |
+ R 380,800 / yr | + R 179,200 / yr |
| 20 |
Custos SynthProof™ Synthetic Fraud & Deepfake Provenance Gate |
KYC & document ingestion gate detecting AI diffusion noise profiles, metadata EXIF tampering, layered PDF revision trailers, and Modulo 10 Luhn checksum anomalies. |
+ R 520,000 / yr $28,000 USD |
+ R 353,600 / yr | + R 166,400 / yr |
| 21 |
Custos ETRadar™ Encrypted Traffic Radar & JA4 Exfiltration Sensor |
Passive TLS 1.3/1.2 wire dissection, JA4/JA4T fingerprinting, real-time Shannon entropy stream scoring, C2 beaconing jitter detection, and 35M ops/sec lock-free ring buffer with automated K8s network quarantine. |
+ R 550,000 / yr $30,000 USD |
+ R 374,000 / yr | + R 176,000 / yr |
| ★ |
Tier-1 Banking Sovereign Enclave (Save 30%) All 6 Core Banking & Interbank Moat Modules |
Complete banking package: AgentFence + WireRemit + QuantumRadar + QueryShield + SynthProof + ETRadar. A-la-carte MSRP is R 3,340,000 / yr. |
+ R 2,338,000 / yr $126,000 USD (Save R 1,002,000) |
+ R 1,589,840 / yr | + R 748,160 / yr |
Interactive Partner Deal & Margin Calculator
Real-time quote structuring for enterprise pitches, channel margin splits, and multi-year renewals.
Base Customer List Value (MSRP):
R 7,290,000 (3-Yr Total)
Customer 3-Year Upfront Savings (15% OFF):
- R 1,093,500 (15% Upfront Savings)
Customer Total Purchase Price (Excl. VAT):
R 6,196,500
Partner Transfer Cost to GovernX (68%):
R 4,213,620
Partner Gross Margin Retained (32%):
R 1,982,880
100% of multi-year software margin paid to your account upfront
2. Global Competitor Benchmark & Commercial Win Strategy
Head-to-head architectural and commercial analysis against US cloud DSPM vendors in banking, telecom, and public sector tenders.
| Platform / Vendor | Annual Software Cost | Deployment Architecture | Why Partners & Clients Win with Custos |
|---|---|---|---|
| BigID | $120,000 – $250,000+ / yr (R 2.2M – R 4.6M ZAR) |
Heavy Kubernetes or Cloud SaaS | Custos Core is ~50% lower cost, runs as a lightweight single binary without cluster sprawl, and doesn't mandate $50k+ BigID professional services. |
| Cyera | $80,000 – $150,000+ / yr (R 1.5M – R 2.8M ZAR) |
US Cloud SaaS only (No on-prem) | Cyera cannot run in air-gapped or on-prem bank networks. Custos keeps 100% of data and classification strictly inside South Africa/client boundaries. |
| Varonis Cloud | $100,000 – $220,000+ / yr (R 1.8M – R 4.0M ZAR) |
Cloud & legacy hybrid agent | Complex user/volume traps lead to severe renewal cost spikes. Custos provides clean, predictable storage-capacity licensing with zero per-user or per-scan penalties. |
| Securiti.ai | $75,000 – $180,000+ / yr (R 1.4M – R 3.3M ZAR) |
Cloud & hybrid agent | High entry threshold for African enterprises and volatile USD invoicing. Custos delivers matched capabilities in fixed ZAR contracts with 32% partner margin. |
| OneTrust | $60,000 – $140,000+ / yr (R 1.1M – R 2.6M ZAR) |
Cloud GRC / Survey SaaS | Relies on manual questionnaires and static surveys. Custos executes automated in-kernel eBPF packet inspection and real-time LLM gateway protection. |
|
★ Custos™ DSPM Core + Modular Add-Ons |
Core 25 TB: R 950k / yr Complete Suite: R 1.59M / yr |
100% Sovereign Single Binary (Air-Gap, Bare-Metal, VPC) |
Fixed Regional & ZAR Invoicing: Zero currency risk. Sub-1M procurement signoff velocity. Turnkey POPIA, Mauritius DPA 2017 & FSC/BoM, and EU GDPR compliance. 32% guaranteed partner margin + 100% services retained. |
1. Zero Forex Volatility
Local Rand pricing protects customer OPEX from USD spikes (e.g. R18+ per dollar), ensuring predictable multi-year budgets.
2. Sub-R1M Signoff Velocity
The R950k Core entry tier enables CISO / Divisional Head delegated signoff, bypassing protracted 12-month public RFP committees.
3. Unified Single Binary
Consolidates DSPM + DSAR Privacy Engine + AI Gateway into a single 38MB zero-dependency daemon, reducing TCO dramatically.
4. Aggressive Partner Economics
Partners capture 32% software margin upfront (R 775k–R 1.3M on 3-yr deals) and retain 100% of billable deployment fees.
3. Channel Partner Deal Structures & Accreditation Tiers
Premier Status
Tier 1 Premier System Integrator (SI)
40% Gross Margin
Engineered for large national & pan-African system integrators managing Tier-1 banking, telecommunications, and government data centers.
- ✓ 40% margin on new licenses and recurring renewals
- 120-Day Exclusive Deal Registration Lock
- Dedicated GovernX Pre-Sales Solutions Architect Co-Pilot
- Free NFR (Not-for-Resale) lab licenses for sovereign staging
- Joint Executive Account Planning & Co-Branded Collateral
- Prioritized Engineering feature requests for regional compliance
Requirement: 2 Certified Deployment Engineers + R 3.5M ($200k) annual qualified pipeline commitment.
Tier 2 Certified Value-Added Reseller (VAR)
30% Gross Margin
Designed for cybersecurity specialty resellers and infrastructure providers serving mid-to-large commercial enterprises.
- ✓ 30% margin on initial deployment and annual renewals
- 90-Day Deal Registration Exclusivity
- Full Access to Partner Portal & Secure Gated Download Vault
- Pre-sales technical collateral and CISO value proposition decks
- Automated Deal Lead routing from governx.co.za regional traffic
Requirement: 1 Accredited Pre-Sales Specialist + Active registered opportunities.
Tier 3 Sovereign MSSP / Managed SOC Partner
45% Wholesale Volume
For Managed Security Service Providers delivering continuous 24/7 sovereign SOC monitoring, SIEM management, and incident response.
- ✓ 45% volume discount or Monthly Active Capacity (MAC)
- Multi-tenant air-gapped management console support
- Pre-built Sentinel, Splunk, and QRadar detection rule bundles
- White-label reporting option with partner-branded sovereign stamps
- Monthly/Quarterly recurring billing reconciliation
Requirement: Operating SOC facility with existing managed security client base.
4. Partner Professional Services Revenue Multipliers (100% Retained by Partner)
Unlike US cloud SaaS vendors who cannibalize deployment and advisory services, GovernX provides pure-play sovereign software. Certified partners capture 100% of billable professional services, creating an average 1.5x to 2.5x services multiplier on top of software license margins.
| Billable Partner Service Offering | Scope & Deliverables | Recommended Partner Billable Value |
|---|---|---|
| Air-Gapped Cluster Staging & Deployment | On-premises bare metal / Kubernetes cluster deployment, eBPF boundary configuration, hardware node licensing. | R 120,000 – R 220,000 $6,500 – $12,000 USD |
| Enterprise Datastore Discovery & Classifier Tuning | Read-only cursor configuration across Oracle RAC, AlwaysOn MSSQL, Postgres, and S3 lakes. Custom POPIA regex tuning. | R 180,000 – R 320,000 $10,000 – $17,500 USD |
| Enterprise SIEM Integration & SOAR Playbooks | Configuration of Sentinel DCE/DCR, Splunk HEC, or QRadar LEEF pipelines. Automated data-leakage quarantine runbooks. | R 90,000 – R 160,000 $5,000 – $8,800 USD |
| Private AI / LLM Streaming Proxy Onboarding | Setting up Custos Guard reverse proxy for internal vLLM / Ollama clusters or enterprise Gemini/Claude completions. | R 150,000 – R 260,000 $8,000 – $14,000 USD |
| Annual Sovereign Compliance & Audit Retainer | Quarterly data drift analysis, statutory audit dossier generation (POPIA, Mauritius DPA 2017 & FSC/BoM, EU GDPR), and cross-border transfer reviews. | R 240,000 – R 480,000 / yr $13,000 – $26,000 / yr USD |
5. Deal Registration & Commercial Protection Rules
First-to-Register Exclusivity
The first accredited partner to log an enterprise opportunity via the Partner Portal (governx.co.za/signin.html) receives exclusive deal protection. GovernX will not register or quote another partner on the same project scope.
90-to-120 Day Deal Hold
Approved deal registrations remain protected for 90 days (VAR) or 120 days (Premier SI). Extensions are automatically granted upon active Proof of Value (POV) milestones or documented procurement cycles.
Turnkey POV Qualification
Qualified enterprise evaluations require a $15,000 USD (approx. R 280,000 ZAR) POV fee paid over to GovernX first. Keys are dispatched immediately, 100% credited against the final enterprise conversion, or 50% refunded to the partner if non-converting.
Statutory Non-Circumvention
All partner engagements are executed under our Western Cape High Court-governed Master Reseller Agreement (MRA), guaranteeing absolute non-circumvention and direct customer ownership by the registering partner.
6. Sustainable Commercial Stepping Stone & Offline Diagnostics
Protecting partner pre-sales margin while providing bank CISOs with an accredited audit deliverable.
A. Turnkey 30-Day Sovereign Proof of Value (POV) Workflow & Settlement
To eliminate uncommitted POC stalls and establish executive budget sponsorship, enterprise evaluations are structured as a paid Turnkey 30-Day Sovereign Proof of Value (POV) at $15,000 USD (approx. R 280,000 ZAR):
- Prepayment to GovernX: The $15,000 USD POV fee must be paid over to GovernX first before deployment.
- Immediate Sovereign Key Provisioning: Upon payment receipt, the node-locked, cryptographically signed 30-day sovereign evaluation key is generated and dispatched to the partner immediately.
- Deliverables Retention: In all cases, the customer permanently retains the comprehensive sovereign audit deliverable, compliance gap analysis, and sensitive data discovery map.
- Delivers actionable compliance gap analysis, automated discovery, and zero-egress validation against POPIA Sec 72, Mauritius DPA 2017 & FSC/BoM directives, EU GDPR Chapter V, NDPA, and SARB.
B. Air-Gapped Support Engine (custos-ctl diagnose)
To support air-gapped environments without expensive on-site travel, Custos includes a kernel-aware self-diagnostic tool that scrubs all PII and credentials before bundle generation:
# Generate sanitized support bundle inside air-gap:
custos-ctl diagnose --scrub-pii --output /tmp/custos-support-bundle.tar.gz
custos-ctl diagnose --scrub-pii --output /tmp/custos-support-bundle.tar.gz
- Zero private keys, passwords, or customer ID numbers leave the bank.
- SHA-256 cryptographic seal certifies bundle for physical media gate clearance.
- Enables Level-1/2 partner engineers to diagnose configuration and performance issues rapidly.
Ready to Accredit Your Organization as a Custos Partner?
Submit your accreditation application via our secure gateway. Approved partners receive the Master Reseller Agreement, gated download credentials, and immediate deal registration access.