If you want a 100% confirmation, you should simply read the terms of service but my understanding is that there is no additional cost for archiving/restoring but there are limits to the amount of data you can restore at any given point in time. I'm not sure - and that is something you'd need to ask your Splunk representative - if there is any possibility (and if so, how costly) to restore the archived data should you need more than the mentioned 10% at one time.
To be honest, I don't understand what kind of transfer fee you'd want to pay if it's all managed by Splunk and the traffic is "internal" to the Splunk Cloud infrastructure (even if it's spread across different cloud provider's environments - it's transparent to you completely).
So maybe we're mixing two different things here.
If your customer gets DDAA - customer pays for the archive solution and it's managed wholly by Splunk and is restorable by submitting a request through Cloud interface.
If your customer gets DDSS - customer needs to provide own storage for which the customer must pay separately (storage and transfer fees if applicable) and in case of a need to restore - the data must be retrieved to a local on-site installation of Splunk Enterprise - it's not restorable to the Cloud instance.
