Privacy

What happens to your request and response bodies

Our edge briefly decrypts traffic only for routing, authentication, and abuse prevention. We do not collect request or response bodies from tunneled traffic, send them to our control plane, logging systems, or analytics systems, or retain them. Bodies shown in Request Inspector exist only in the memory of your Connector on your own machine.

Separately, evidence that a third party submits to us in an abuse report may contain request or response bodies. This is the sole body-content exception, and Viastead does not collect it from tunneled traffic. The evidence is stored in an encrypted evidence vault that is physically isolated from our production logging systems, is not searchable by default, and can be retrieved only by case ID. Unless subject to a legal hold, it is automatically deleted 180 days after the case is closed. A legal hold pauses the deletion timer; when the hold is released, the timer resumes for the remaining retention period. A legal hold does not make the evidence permanent.

The rest of this policy

The section above is final wording. The remainder of the privacy policy — the account data we hold, retention periods, sub-processors and your rights — is still with counsel, and is not published here until that review is complete.