===== PAGE 1 ===== ## Split Deployment — France Their data plane and our analysis plane both run in France, on separate hardware, joined only by a federated message link. PROPOSED AUGUST 2026 ## Their infrastructure DATA PLANE · FRANCE · THEIR HARDWARE · THEIR DPA · STATEFUL Gateway, 40+ frontends, ~30 data services, MySQL, object store and their own broker. Every finding, screenshot, document, PII analysis and user account lives here. PRIVATE LINK mTLS federation WireGuard or IPsec

Traefik gateway	accounts-api	40+ frontends
~30 data services	MySQL 8.4	object store their broker
DETAIL ON PAGE 2

← verdicts crawl jobs ## Our infrastructure ANALYSIS PLANE · FRANCE · OUR HARDWARE · OUR IP · STATELESS

Broker, crawler fleet, engine-service, ai-facade and Redis. It holds the tests and prompts and nothing else — no findings, no accounts, no documents. our broker crawler-manager crawler ×10 ai-facade engine-service Redis DETAIL ON PAGE 3

WHERE THE LINE FALLS	ANALYSIS PLANE - OURS	DATA PLANE - THEIRS
Holds	Tests, crawler, AI prompts	Every result, document, screenshot, account
State	None that survives a restart	All of it
Reachable by	Their broker, over the private link	Their browsers, directly
If they leave	We keep the IP	They keep their data

===== PAGE 2 ===== ## Their infrastructure — what runs on their server ## DATA PLANE · FRANCE · THEIR HARDWARE · THEIR DPA ## Their staff browsers, inside their estate ## Traefik gateway

## HTTPS ## 40 + frontends ## Data services ### MySQL 8.4 16 schemas, one per service ## Object store ## EVERYTHING STORED HERE Findings, screenshots, documents, PII analysis, remediation tracking and every user account — on infrastructure they own, under their own DPA. ## What they control Database backups, access controls and disaster recovery. No analytics and no telemetry leave this estate — we cannot read their results. Single-jurisdiction infrastructure: no multi-region replication to reason about. ## HOW THEY REACH US They never call us over HTTP. Their frontends and services talk only to their own broker; the broker federates across the private link. ===== PAGE 3 ===== ## Our infrastructure — what runs on our server ## ANALYSIS PLANE · FRANCE · OUR HARDWARE · OUR IP ## Our RabbitMQ broker publishes results out · never stores them ## FEDERATED crawler-manager assigns crawl slots crawler ×10 renders pages · runs 6 passes ## engine-service single-URL scans ## ai-facade holds the prompt set ## Redis frontier · seen-set · slot queue — nothing survives a restart ## ★ NEVER LEAVES THIS BOX 86 WCAG SC test files content analyzer SEO / GEO analyzers web security analyzer PDF remediation engine data privacy analyzer AI prompt set Not compiled into their binaries, not shipped as an image they can inspect, not present in their database. They receive verdicts only. ## NOTHING STORED HERE No findings, no accounts, no documents. Their data never travels to or resides on our infrastructure — which is why no code disclosure is needed. OUTBOUND HTTPS ## Their public websites the pages under test, fetched by the crawlers ## OUTBOUND HTTPS ▲ ## OpenAI Calls may include page content. Their DPO should review OpenAI's DPA, or AI features can be disabled. ===== PAGE 4 ===== ## One crawl, end to end ## 01 ## THEIRS ## Scan requested A user in their UI asks for a crawl; the data service records the job. ## 02 ## THEIRS ## Job onto their queue The request is published to their broker — no HTTP call to us. ## 03

## Federated across The job crosses the mTLS private link to our broker. ## 04 ## Slots assigned ## OURS crawler-manager claims a slot in Redis and dispatches crawlers. Crawlers fetch their public pages and run WCAG, Content, SEO, GEO, Security and Privacy. ## 05

## Six passes run ## 06

Structured results — not rules — federate back to their broker. ## Verdicts published ## 07 ## THEIRS ## Stored and shown Their data services write to MySQL and the object store; the UI updates. ## NET EFFECT Verdicts move, data doesn't They hold every byte of customer data; we hold every line of analysis IP. ## Why this holds up No shared secrets — the link authenticates with mTLS certificates, not API keys. No API exposure — our analysis services answer no HTTP; the queue is the only door. Outage resilient — if the link drops, both queues buffer until it recovers. Independent audit — both brokers log federation, reviewable on either side. One exception — ai-facade calls OpenAI and may include page content; their DPO decides. ## If they leave They export findings, evidence and remediation tracking from their own data services. We stop publishing to their queue and the private link is decommissioned. They keep every finding, screenshot, document and account – no data escrow needed. We retain the full analysis IP; no code was ever disclosed, so none is recovered.