Over-the-Shoulder Upgrades: Why Your IT Lead Runs the Script, Not Us | Insights

Most managed IT vendors perform maintenance by logging into your server, executing the work, and sending you a summary afterwards. That model makes the vendor a Data Processor for the duration of every maintenance session — and in many cases, permanently, because the vendor retains standing access credentials between sessions. Private AI Ltd does neither. We do not log in. We do not execute. We do not retain credentials. Your IT lead runs the script. We watch.

This is the Over-the-Shoulder (OTS) upgrade model — the maintenance architecture that delivers enterprise-grade technical support while keeping Private AI Ltd permanently outside the Data Processor boundary, even during upgrades.

For the Zero-Touch Provisioning model that eliminates Data Processor liability, read our parent article. This piece explains the operational mechanics of how upgrades actually work — step by step.

The Clean Screen Policy Schedule: A Binding Contractual Control

Before any screen-sharing session begins, a binding contractual Schedule governs what the firm’s IT lead may and may not display.

The Clean Screen and Dummy Data Policy Schedule — executed as part of the service agreement — contractually prohibits the client from displaying live personal data, unredacted conversation logs, unredacted document content, or live retrieval query results during any screen-sharing session with Private AI Ltd.

The IT lead must:

Close all application windows displaying live data before initiating screen share
Use only the system terminal, script execution output, and service status logs during the session
Refrain from opening the user interface, client documents, or any application-layer surface

This Schedule contractually shifts liability for any accidental data display entirely to the Data Controller — the firm. Breach constitutes a material contract violation. The Schedule legally isolates Private AI Ltd from GDPR Article 4(2) processing during Over-the-Shoulder sessions.

The result: even though Private AI Ltd’s engineer has visual access to the IT lead’s shared screen, the content visible is restricted to terminal output, system service status, and script execution logs. No client data. No personal data. No processing.

The Upgrade Session: What Happens in Under 15 Minutes

The IT lead joins a brief secure video call with Private AI Ltd’s engineer. The engineer guides the IT lead through the following sequence:

Step 1: Establish the authenticated session. The IT lead authenticates into the environment — two-factor authentication is required before access is granted. No port is publicly exposed. Private AI Ltd does not connect. The IT lead connects.

Step 2: Execute the upgrade script. Private AI Ltd has supplied a pre-tested, deterministic upgrade script for this maintenance cycle. The IT lead runs a single command. The deterministic upgrade routine handles the full sequence:

SBOM drift check — compares the current installed dependencies against the baseline manifest. Halts if unauthorised modifications detected.
Maintenance path open — the environment is configured for the update sequence, including DNS routing for the duration of the window.
Interface stop — halts the workspace service. Synchronous and blocking. The init system confirms absolute process termination.
Inference engine stop — halts the inference engine service. Same synchronous guarantee.
Pre-migration storage snapshot — database-integrity backup plus directory copy for vector database state. Executed only after confirmed termination ensures zero file locks.
Egress confirmed — routing verified.
Dependency upgrade — hash-checked install from the locked dependency manifest. Atomic. Cryptographically enforced. Any hash mismatch halts the install.
Forward verification — dependency-tree integrity check. Emits SUCCESS: dependency integrity verified or HALT: Baseline Verification FAILED.
Inference package verification — checksum match against pre-seeded baseline. Mismatch → package rejected → abort.
Maintenance path closed, services restarted — configuration restored to Default Operating State, status confirmed.

The script emits SUCCESS: Cryptographic Baseline Verified on complete success. Any failure at any step triggers an abort with a machine-readable HALT code, and the pre-migration snapshot provides a clean rollback path.

Step 3: Confirm the service is accessible. The IT lead opens the AI interface in a browser, confirms it loads, and the call ends.

Total elapsed time: under 15 minutes. Total Private AI Ltd access to the firm’s systems: zero. The engineer watched. The IT lead executed. The script did the work.

Why This Is Not a Data Processing Event

The legal analysis is precise and deliberate.

Under the standing DPA, Over-the-Shoulder Support is explicitly defined as not a Qualifying Support Event under Schedule 2. The standing DPA defines:

The Provider’s engineer may observe but does not operate, access, or control any system
No Processing of Personal Data by the Provider occurs during OTS Support
OTS Support does not constitute a Level 1 or Level 2 access event under Schedule 2

No active processing occurs. Private AI Ltd’s Zero Standing Privileges architecture means no credentials are held and no active connection is established. The firm does not need to update its Article 30 Records of Processing Activities. The firm does not need to conduct a DPIA reassessment. The firm does not need to notify the ICO or any client.

This holds because the Clean Screen Policy ensures no personal data is visible, and because Private AI Ltd’s engineer has no input device connected to the firm’s systems. The engineer cannot type commands. The engineer cannot click interfaces. The engineer cannot access files. The engineer observes terminal output on a shared screen and provides verbal guidance. That is observation, not processing.

When OTS Is Not Enough: The JIT Escalation Path

In rare cases — a complex database migration failure, a system service that will not restart, a network configuration issue that requires hands-on diagnosis — Over-the-Shoulder guidance may be insufficient. The firm’s IT lead may lack the technical depth to execute the resolution independently.

For these scenarios, the firm can escalate to Just-In-Time (JIT) Support under the standing Data Processing Agreement. The IT lead opens a time-limited access channel and grants Private AI Ltd temporary access for a defined maintenance window. This constitutes a Level 1 or Level 2 access event under Schedule 2 of the standing DPA — strictly confined to system-level maintenance, with absolute prohibitions on data extraction, persistent access, and commingling, and with full keystroke audit logging.

Upon completion, the IT lead closes the access channel and revokes the access credential. The Qualifying Support Event is logged in the register.

JIT Support is the exception. OTS Support is the standard. In practice, the deterministic upgrade routine handles the overwhelming majority of maintenance cycles without escalation. The script is designed to be deterministic, self-recovering, and executable by an IT lead with basic command-line competence.

What Your IT Lead Actually Does

The firm’s IT lead requirement for each OTS upgrade session is minimal:

Join a video call (10–15 minutes)
Establish an authenticated session
Execute one script
Confirm the service is accessible
End the call

No system administration expertise beyond basic command execution is required. The script handles every technical operation. The engineer provides real-time verbal guidance. The IT lead’s role is to authenticate, execute, and confirm — not to diagnose, troubleshoot, or configure.

The firm receives SUCCESS: Cryptographic Baseline Verified in the terminal. The engineer confirms it on screen. The session recording captures it for the audit record. The maintenance is complete. Private AI Ltd touched nothing.

Talk to our team to see a live demonstration of the OTS upgrade process and understand how the Clean Screen Policy integrates with your organisation’s data governance framework.

Private AI Ltd (SC881079)