> For the complete documentation index, see [llms.txt](https://faction-os.gitbook.io/faction-os-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://faction-os.gitbook.io/faction-os-docs/public-website/docs/archive-docs_public-website/security-privacy-and-claim-boundaries.md).

# Security, Privacy, And Claim Boundaries

The public website is static Astro output. It explains FactionOS, but it is not the runtime product, not a hosted dashboard, not a telemetry collector, and not a legal approval artifact.

## Current Security Summary

Launch handoff on 2026-06-02 recorded:

| Area                         | Status   | Boundary                                                                    |
| ---------------------------- | -------- | --------------------------------------------------------------------------- |
| Data collection              | passed   | Built output has no hosted collection path.                                 |
| Analytics                    | passed   | No active analytics or tracker scripts in built output.                     |
| Hosted forms                 | passed   | No `<form>` markup in built output.                                         |
| Browser storage writes       | passed   | No local/session storage write patterns in built output.                    |
| Cookie writes                | passed   | No cookie write patterns in built output.                                   |
| Runtime network calls        | passed   | No `fetch`, `WebSocket`, `EventSource`, or beacon patterns in built output. |
| Credential handling          | passed   | Cloudflare credential checks record presence only, not values.              |
| Production-hosted validation | no-claim | Requires authorized Pages deploy and HTTPS smoke.                           |
| Legal/privacy owner approval | pending  | Legal and privacy pages remain pre-review.                                  |

## Static Website Boundary

The website must not collect or process:

* prompts
* local file paths
* source code
* terminal output
* replay data
* demo session payloads
* diagnostics
* credentials
* local event snapshots
* user identity

The first-release site has no runtime mechanism to collect those values.

## Built-Output Privacy Gate

`../../scripts/check-public-website-links.mjs` validates built output for:

* tracker hosts
* tracker snippets
* hosted forms
* browser storage writes
* cookie writes
* beacon calls
* `fetch`
* `WebSocket`
* `EventSource`
* approved external origins
* guarded copy patterns
* legal pre-review markers

Run:

```bash
npm --workspace @factionos/public-website run build
npm --workspace @factionos/public-website run check:links
```

## Approved External Destinations

The current approved external destinations are:

* `https://demo.faction-os.com/`
* `https://faction-os.gitbook.io/faction-os-docs`

Current mailto destinations use `faction-os.com` mailboxes:

* `hello@faction-os.com`
* `security@faction-os.com`
* `press@faction-os.com`
* `investors@faction-os.com`
* `partners@faction-os.com`

Do not add other external origins without updating source, checker allowlists, and docs.

## Product Claim Guardrails

Do not claim:

* hosted collaboration is required for the core workflow
* external adapters provide inbound command control
* the public demo uses real user data or customer telemetry
* prompts, local paths, source files, terminal output, credentials, replay data, or diagnostics upload by default
* revenue, adoption, traction, ROI, funding, market-size, or customer proof
* formal certification
* production-hosted validation
* hosted identity
* hosted storage
* trusted erasure
* legal/privacy owner approval before approval exists

Allowed wording:

* Local static launch gates passed.
* The Cloudflare Pages deployment path is configured.
* The website is ready for an authorized static deploy attempt.
* The public demo is synthetic and separate.
* The public docs are external and separate.
* Legal/privacy pages are pre-review where marked.

## Legal Page Status

These pages are pre-review:

* `/legal`
* `/legal/privacy`
* `/legal/terms`
* `/legal/acceptable-use`

Required markers:

* "Pre-review policy index" and "Prepared for owner/legal review" on `/legal`.
* "Pre-review placeholder" and "Owner/legal review required" on policy detail pages.

Do not remove these markers until owner/legal approval is recorded in stable docs and source copy.

## Analytics Policy

Analytics is absent by default.

Future analytics must be scoped separately and satisfy all of the following:

* owner approval
* explicit documentation
* opt-in or approved consent posture
* payload scrub tests
* no prompts
* no local paths
* no source files
* no replay data
* no terminal output
* no credentials
* no user-provided code
* no heatmap/session replay/console capture
* built-site checker updates

The current repo mentions Umami as a future guardrail direction, but no analytics adapter is wired into the public website.

## Forms Policy

There are no hosted forms.

Contact is handled through mailto links. A future hosted form requires a scoped decision covering:

* spam protection
* retention
* privacy policy update
* consent
* accessibility
* data storage
* deletion workflow
* third-party processor review
* built-site checker changes

## Cloudflare Credential Boundary

Cloudflare credentials are deploy-only:

* `CLOUDFLARE_ACCOUNT_ID`
* `CLOUDFLARE_API_TOKEN`

They must not be:

* written to source files
* committed to docs
* printed in issue comments
* exposed in browser config
* required for local development
* used by the static site at runtime

The workflow records only availability and sanitized skip/smoke status.

## Hosted Claim Boundary

| Claim area                                     | Current status | Allowed wording                                      |
| ---------------------------------------------- | -------------- | ---------------------------------------------------- |
| Local static build readiness                   | passed         | May be claimed for local static gates.               |
| Cloudflare Pages workflow readiness            | passed         | May describe configured deploy path.                 |
| Live `https://faction-os.com/` deploy          | no-claim       | Do not claim without authorized deploy evidence.     |
| Production HTTPS smoke                         | no-claim       | Do not claim without live deploy plus bounded smoke. |
| Hosted identity                                | no-claim       | Website is static and adds no identity.              |
| Hosted storage                                 | no-claim       | Website is static and adds no storage.               |
| Trusted erasure                                | no-claim       | No hosted lifecycle exists in website scope.         |
| Formal accessibility or security certification | no-claim       | Local QA is not certification.                       |

## GDPR And Legal Review

The static website launch adds no forms, analytics, cookies, storage writes, or runtime network collection. That keeps GDPR collection risk out of the current static launch scope.

This is not legal approval. Privacy, terms, and acceptable-use pages remain pending owner/legal review.

## Security Update Procedure

When adding any feature that changes the static privacy boundary:

1. Write the proposed behavior and data flow.
2. Identify data classes touched.
3. Update `src/data/site.ts` copy guardrails.
4. Update the relevant page/data files.
5. Update `../../scripts/check-public-website-links.mjs`.
6. Update this document and legal/privacy docs if affected.
7. Run full website gates.
8. Record no-claim, pending, passed, failed, blocked, or unavailable evidence with exact dates.

Do not ship privacy-affecting runtime behavior as a small incidental change.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://faction-os.gitbook.io/faction-os-docs/public-website/docs/archive-docs_public-website/security-privacy-and-claim-boundaries.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.