Privacy
Minimize telemetry, avoid bodies by default and publish retention and deletion behavior.
Commercial terms, privacy notice, DPA, acceptable-use policy, subprocessors and incident procedures are release gates for paid service.
Each function has a narrow operating boundary and a state derived from evidence.
Minimize telemetry, avoid bodies by default and publish retention and deletion behavior.
Scanning, proxying and response require verified ownership and explicit technique limits.
Terms, DPA, AUP, SLA and subprocessors require Romanian and EU legal review.
The visitor path remains short while control, evidence and rollback stay explicit.
Describe data, authority, responsibilities and exclusions.
Obtain written legal and privacy assessment.
Store versioned customer acceptance before activation.
Every traffic activation requires ownership, certificate, origin and rollback checks.