What the proxy sees, and what happens to it.

This policy is published by DEFLECTO LLC, registered at [[REGISTERED_ADDRESS]] (referred to here as DEFLECTO, we, us). It covers the DEFLECTO web application firewall and reverse proxy, the customer control panel, and this website.

There are two distinct relationships in this product, and the data protection roles are different in each. Reading the rest of this document without that distinction will give you the wrong answer.

A filtering decision is a function of the request. There is no version of this product that protects a site without reading what arrives at it. The following is processed on every request:

Source IP address

The address the connection came from, or the client address supplied by a trusted upstream proxy where one is configured. Rate limits, ban ladders, allow lists and the proof-of-work client binding are all keyed on it. Without it there is no way to distinguish one client from a million.

Request line and headers

Method, path, query string, host, user agent, referer, cookie names, content type and length, and the remaining headers. Rules match on these, so they are read in full.

TLS characteristics

Negotiated version, cipher suite and handshake fingerprint. A client that presents a browser user agent over a handshake no browser produces is a strong and cheap signal, which is why it is collected.

Timing and response

Timestamp, the verdict reached (allow, log, challenge, block, drop), the rule or ladder that produced it, upstream status code, byte counts and latency.

Request body

Inspected in memory when body rules apply to the route. See clause 2.1.

When a client looks automated but is not clearly hostile, DEFLECTO serves a proof-of-work interstitial instead of blocking it. The client computes a hash puzzle in the browser, posts the solution back, and receives a clearance cookie which stops it being asked again.

Identity and contact

Name, business name, email address, and the domains you ask us to protect.

Authentication

A password hash and control panel session records. We never hold a password in a form we can read.

Billing

Plan, billing cycle, invoices and payment status. Card details are handled by our payment processor and never reach our systems.

Support

Tickets and correspondence, including anything you attach to them.

Operational

Configuration history, rule changes, allow list entries and administrative actions, kept so an unexpected change can be traced to the person who made it.

Where the GDPR or an equivalent regime applies, we rely on the following. Where we act as processor, the lawful basis is the controller's to establish, and these are the bases we expect them to rely on.

Legitimate interests

Article 6(1)(f), for filtering traffic, detecting and mitigating attacks, and keeping the network available. Recital 49 of the GDPR names network and information security as a legitimate interest in terms, and the processing is limited to what a filtering decision needs.

Contract

Article 6(1)(b), for providing the service, operating your account, metering usage and invoicing you.

Legal obligation

Article 6(1)(c), for tax and accounting records, and for responding to lawful requests from an authority with jurisdiction over us.

Consent

Only where you give it, for example if you subscribe to product announcements. Withdrawable at any time, and never required to use the service.

We do not sell data, and we do not disclose traffic data to anyone except as set out here.

• Infrastructure providers hosting the edge nodes and the control plane.
• A payment processor, which receives billing identifiers and never receives traffic data.
• Transactional email delivery, for account notices and alerts.
• Where a reseller sold you the service, that reseller, limited to your account and usage data.
• A competent authority, where we are compelled by a law that binds us. We will notify the affected customer unless we are prohibited from doing so.

A current list of sub-processors is available from support@deflecto.net. Customers acting as controllers are notified before a new sub-processor is engaged and may object on reasonable data protection grounds.

An anycast network answers a request from whichever node is nearest to the client, so traffic from a visitor in one country may be filtered by a node in another. Where that moves personal data outside the EEA or the UK, the transfer is covered by the European Commission's standard contractual clauses, the UK addendum where the UK GDPR applies, or an adequacy decision where one is in force for the destination.

Customers who need traffic confined to a specific region should raise it before onboarding. Region pinning changes which nodes will answer for your domains and cannot be applied retroactively.

• TLS in transit for the control panel, the node API and the control plane, and encryption at rest for the databases holding account and event data.
• Access to production is limited to named engineers, requires multi-factor authentication, and is logged.
• Node credentials are single-use and rotatable, and the proof-of-work signing secret supports rotation with a previous key so that a rotation does not challenge every visitor at once.
• Passwords are stored only as hashes with a modern key derivation function.
• Changes to configuration are recorded with the actor who made them.

No control set makes a system impossible to breach. These are the measures we consider appropriate to the risk, and they are reviewed as the product changes.

Where we are controller and a breach is likely to result in a risk to people, we notify [[SUPERVISORY_AUTHORITY]] within 72 hours of becoming aware of it, and we notify the affected individuals directly where the risk is high.

Where we are processor, we notify the affected customer without undue delay after becoming aware, with what we know at the time rather than waiting for a complete picture, and we provide the information that customer needs to make its own notification.

Subject to the conditions in the applicable law, you have the right to access your data, to have it corrected, to have it erased, to restrict or object to processing, to receive it in a portable form, and to withdraw consent where consent was the basis. You also have the right to complain to a supervisory authority, which for us is [[SUPERVISORY_AUTHORITY]], and to the authority in your own country of residence.

• We do not sell, rent or trade traffic data or account data.
• We do not use traffic data for advertising, and there is no advertising technology in the product.
• We do not use customer traffic, request bodies or support correspondence to train machine learning models.
• We do not build cross-customer profiles of visitors. The proof-of-work binding is deliberately scoped so that the same browser is unrecognisable between two customers.
• We do not retain request or response bodies.
• We do not decrypt or inspect traffic for any purpose other than forming a filtering verdict and forwarding the request.

DEFLECTO is sold to businesses and is not directed at children. We do not knowingly collect account data from anyone under 16. Traffic data may of course originate from a visitor of any age, and it is processed on the basis in clause 5 and retained under clause 6 without regard to who sent it, because we have no way to know and no interest in finding out.

Material changes are notified to account holders by email at least 30 days before they take effect, and the date at the top of this page is updated. Changes that only clarify existing wording take effect on publication.

This section is about deflecto.net, the site you are reading. It is separate from clause 3, which covers the clearance cookie the proxy sets on a protected site. The two are unrelated, set by different systems, for different reasons.

Data protection contact: [[DPO_CONTACT]]. General support: support@deflecto.net. Sales and contracts: sales@deflecto.net. Registered entity and address: DEFLECTO LLC, [[REGISTERED_ADDRESS]].