From fced858a7a5899346cb9b8b97229a795c4caaaaf Mon Sep 17 00:00:00 2001 From: Oliver Kieselbach Date: Tue, 21 Jul 2026 13:42:03 +0200 Subject: [PATCH] feat(legal,agent): professionalize Terms/Privacy; wire SendTraceEvents gate Rework the public Terms of Use and Privacy Policy from their early-days wording to match how the service actually runs today, and fix a setting that looked like a privacy control but gated nothing. Legal positioning: - glueckkanja AG operates the service and is the counterparty on BOTH plans (Community/Enterprise is a flag in one system, one subscription). Oliver Kieselbach is named as creator and maintainer of the open-source project and the Community edition, acting on behalf of glueckkanja AG and explicitly not a separate contracting party. - Community: free, "AS-IS", no availability or support commitment. Enterprise: written agreement incl. DPA, higher limits, MSP delegation. - Added business-use-only clause, simplified governing law (dropped the CISG exclusion - it governs sale of goods, not SaaS), split liability per plan, added an MSP delegation section and a rules-contribution clause covering the community rule pool. - Imprint links to the glueckkanja AG imprint, whose scope clause covers every service linking to it - no duplicated company data to go stale. Reachable from the landing footer and both help menus. Privacy Policy corrections (previous claims were inaccurate): - "No personal data is transmitted" - backend telemetry carries the UPN; only the browser SDK is cookie- and UPN-free. - "Not shared with third parties" - qualified for MSP delegation, customer-configured notification channels, the customer's own LLM via MCP, and agent-side geolocation. - Removed "data subject rights are not guaranteed"; GDPR rights are not optional. Added region, sub-processors, retention and IP handling. Agent - SendTraceEvents gate: The setting was plumbed from TenantConfiguration through to AgentConfiguration but never consumed; Trace severity only hides an event from the timeline view. The outbound IP was therefore always collected when geolocation is on (which is the default). Gate is now enforced in TelemetryEventEmitter.Emit, the single choke point before the transport enqueue. Dropped before the sequence counter advances so suppression leaves no gaps. Evaluated per event via Func so a mid-session remote-config merge takes effect. Fails open: an unwired or throwing accessor lets trace events flow, because the gate suppresses diagnostics and must not silently blind the timeline. Default stays on and the switch remains operator-only via the config table - deliberately not surfaced in the UI or documentation. Verified: solution builds clean, 1873 agent core tests pass, tsc --noEmit clean. Co-Authored-By: Claude Opus 4.8 (1M context) --- .../Events/TelemetryEventEmitterTests.cs | 98 ++++++- .../Orchestration/EnrollmentOrchestrator.cs | 12 +- .../Telemetry/Events/TelemetryEventEmitter.cs | 39 ++- .../Runtime/AgentRuntimeHost.cs | 5 +- .../autopilot-monitor-web/app/about/page.tsx | 8 +- src/Web/autopilot-monitor-web/app/page.tsx | 3 +- .../app/privacy/page.tsx | 244 +++++++++++++----- .../autopilot-monitor-web/app/terms/page.tsx | 142 ++++++++-- .../components/Navbar.tsx | 17 ++ 9 files changed, 476 insertions(+), 92 deletions(-) diff --git a/src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Telemetry/Events/TelemetryEventEmitterTests.cs b/src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Telemetry/Events/TelemetryEventEmitterTests.cs index a55827a5..99b776a4 100644 --- a/src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Telemetry/Events/TelemetryEventEmitterTests.cs +++ b/src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Telemetry/Events/TelemetryEventEmitterTests.cs @@ -17,13 +17,25 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Telemetry.Events FakeTelemetryTransport transport, out EventSequenceCounter counter, string sessionId = "sess-1", - string tenantId = "tenant-1") + string tenantId = "tenant-1", + Func? traceEventsEnabled = null) { var tmp = new TempDirectory(); counter = new EventSequenceCounter(new EventSequencePersistence(tmp.File("seq.json"))); - return new TelemetryEventEmitter(transport, counter, sessionId, tenantId); + return new TelemetryEventEmitter(transport, counter, sessionId, tenantId, traceEventsEnabled); } + private static EnrollmentEvent NewTraceEvent(string eventType = "outbound_ip") => + new EnrollmentEvent + { + EventType = eventType, + Severity = EventSeverity.Trace, + Source = "test", + Timestamp = At, + Phase = EnrollmentPhase.Unknown, + Message = "trace message", + }; + private static EnrollmentEvent NewTestEvent(string eventType = "enrollment_complete") => new EnrollmentEvent { @@ -49,6 +61,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Telemetry.Events Assert.Equal("sess-1", evt.SessionId); Assert.Equal("tenant-1", evt.TenantId); + Assert.NotNull(item); Assert.Equal(TelemetryItemKind.Event, item.Kind); Assert.Equal("tenant-1_sess-1", item.PartitionKey); Assert.Equal(evt.RowKey, item.RowKey); @@ -174,5 +187,86 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Telemetry.Events Assert.Equal("test-reason", (string?)data["reason"]); Assert.Equal("Strong", (string?)data["wgConfidence"]); } + + // ============================================================ Trace-event gate + + [Fact] + public void Trace_event_is_dropped_when_gate_is_off() + { + var transport = new FakeTelemetryTransport(); + var emitter = Build(transport, out _, traceEventsEnabled: () => false); + + var item = emitter.Emit(NewTraceEvent()); + + Assert.Null(item); + Assert.Equal(0, transport.EnqueueCount); + } + + [Fact] + public void Trace_event_flows_when_gate_is_on() + { + var transport = new FakeTelemetryTransport(); + var emitter = Build(transport, out _, traceEventsEnabled: () => true); + + Assert.NotNull(emitter.Emit(NewTraceEvent())); + Assert.Equal(1, transport.EnqueueCount); + } + + [Fact] + public void Trace_event_flows_when_no_gate_is_wired() + { + var transport = new FakeTelemetryTransport(); + var emitter = Build(transport, out _); + + Assert.NotNull(emitter.Emit(NewTraceEvent())); + Assert.Equal(1, transport.EnqueueCount); + } + + [Fact] + public void Gate_off_does_not_suppress_non_trace_events() + { + var transport = new FakeTelemetryTransport(); + var emitter = Build(transport, out _, traceEventsEnabled: () => false); + + foreach (var severity in new[] { EventSeverity.Info, EventSeverity.Warning, EventSeverity.Error }) + { + var evt = NewTestEvent(); + evt.Severity = severity; + Assert.NotNull(emitter.Emit(evt)); + } + + Assert.Equal(3, transport.EnqueueCount); + } + + [Fact] + public void Dropped_trace_event_does_not_consume_a_sequence_number() + { + var transport = new FakeTelemetryTransport(); + var traceAllowed = true; + // ReSharper disable once AccessToModifiedClosure — deliberate: the gate is read + // per event, mirroring a mid-session remote-config merge. + var emitter = Build(transport, out _, traceEventsEnabled: () => traceAllowed); + + emitter.Emit(NewTestEvent()); // seq 1 + traceAllowed = false; + emitter.Emit(NewTraceEvent()); // dropped — must not burn seq 2 + emitter.Emit(NewTestEvent()); // seq 2 + + Assert.Equal(2, transport.EnqueueCount); + var first = JObject.Parse(transport.Enqueued[0].PayloadJson); + var second = JObject.Parse(transport.Enqueued[1].PayloadJson); + Assert.Equal(1, (long)first["Sequence"]!); + Assert.Equal(2, (long)second["Sequence"]!); + } + + [Fact] + public void Throwing_gate_fails_open_so_diagnostics_are_never_silently_lost() + { + var transport = new FakeTelemetryTransport(); + var emitter = Build(transport, out _, traceEventsEnabled: () => throw new InvalidOperationException("boom")); + + Assert.NotNull(emitter.Emit(NewTraceEvent())); + Assert.Equal(1, transport.EnqueueCount); + } } } diff --git a/src/Agent/AutopilotMonitor.Agent.V2.Core/Orchestration/EnrollmentOrchestrator.cs b/src/Agent/AutopilotMonitor.Agent.V2.Core/Orchestration/EnrollmentOrchestrator.cs index 86de7d52..0cef88d2 100644 --- a/src/Agent/AutopilotMonitor.Agent.V2.Core/Orchestration/EnrollmentOrchestrator.cs +++ b/src/Agent/AutopilotMonitor.Agent.V2.Core/Orchestration/EnrollmentOrchestrator.cs @@ -86,6 +86,11 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration // Production always passes null → Start() creates the real DeadlineScheduler. private readonly IDeadlineScheduler? _schedulerOverride; + // Live accessor for TenantConfiguration.SendTraceEvents — read per event by the + // TelemetryEventEmitter so a mid-session remote-config merge takes effect. Null + // (tests / legacy callers) means trace events always flow. + private readonly Func? _traceEventsEnabled; + // Max-lifetime watchdog (M4.6.α). Timer is armed in Start() when _agentMaxLifetime != null. private System.Threading.Timer? _maxLifetimeTimer; private int _terminatedFired; @@ -166,7 +171,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration TimeSpan? terminalDrainTimeout = null, TimeSpan? agentMaxLifetime = null, int uploadBatchSize = 100, - IDeadlineScheduler? schedulerOverride = null) + IDeadlineScheduler? schedulerOverride = null, + Func? traceEventsEnabled = null) { if (string.IsNullOrEmpty(sessionId)) throw new ArgumentException("SessionId is mandatory.", nameof(sessionId)); if (string.IsNullOrEmpty(tenantId)) throw new ArgumentException("TenantId is mandatory.", nameof(tenantId)); @@ -206,6 +212,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration _uploadBatchSize = uploadBatchSize; _schedulerOverride = schedulerOverride; + _traceEventsEnabled = traceEventsEnabled; } /// @@ -402,7 +409,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration // strukturelle Abhängigkeit erlischt damit, Architektur-Baseline-Test gate // shrinks to exactly two permitted callers. _eventSequenceCounter = new EventSequenceCounter(_eventSequencePersistence); - var eventEmitter = new TelemetryEventEmitter(_transport, _eventSequenceCounter, _sessionId, _tenantId); + var eventEmitter = new TelemetryEventEmitter( + _transport, _eventSequenceCounter, _sessionId, _tenantId, _traceEventsEnabled); _signalEmitter = new TelemetrySignalEmitter(_transport, _sessionId, _tenantId); _transitionEmitter = new TelemetryTransitionEmitter(_transport, _sessionId, _tenantId); _timelineEmitter = new EventTimelineEmitter(eventEmitter); diff --git a/src/Agent/AutopilotMonitor.Agent.V2.Core/Telemetry/Events/TelemetryEventEmitter.cs b/src/Agent/AutopilotMonitor.Agent.V2.Core/Telemetry/Events/TelemetryEventEmitter.cs index ad9ef7eb..faa08123 100644 --- a/src/Agent/AutopilotMonitor.Agent.V2.Core/Telemetry/Events/TelemetryEventEmitter.cs +++ b/src/Agent/AutopilotMonitor.Agent.V2.Core/Telemetry/Events/TelemetryEventEmitter.cs @@ -30,12 +30,14 @@ namespace AutopilotMonitor.Agent.V2.Core.Telemetry.Events private readonly string _sessionId; private readonly string _tenantId; private readonly string _partitionKey; + private readonly Func? _traceEventsEnabled; public TelemetryEventEmitter( ITelemetryTransport transport, EventSequenceCounter sequenceCounter, string sessionId, - string tenantId) + string tenantId, + Func? traceEventsEnabled = null) { if (string.IsNullOrEmpty(sessionId)) throw new ArgumentException("SessionId is mandatory.", nameof(sessionId)); if (string.IsNullOrEmpty(tenantId)) throw new ArgumentException("TenantId is mandatory.", nameof(tenantId)); @@ -44,13 +46,18 @@ namespace AutopilotMonitor.Agent.V2.Core.Telemetry.Events _sessionId = sessionId; _tenantId = tenantId; _partitionKey = $"{tenantId}_{sessionId}"; + _traceEventsEnabled = traceEventsEnabled; } /// /// Weist Sequence zu, serialisiert im Legacy-Wire-Format und enqueued via Transport. /// Thread-safe (EventSequenceCounter + ITelemetryTransport.Enqueue beide unter Lock). + /// + /// Returns null when the event was suppressed by the trace-event gate — the + /// only drop path. Both permitted callers ignore the return value. + /// /// - internal TelemetryItem Emit(EnrollmentEvent evt) + internal TelemetryItem? Emit(EnrollmentEvent evt) { if (evt == null) throw new ArgumentNullException(nameof(evt)); if (string.IsNullOrEmpty(evt.EventType)) @@ -58,6 +65,16 @@ namespace AutopilotMonitor.Agent.V2.Core.Telemetry.Events throw new ArgumentException("EnrollmentEvent.EventType is mandatory.", nameof(evt)); } + // Trace-event gate (TenantConfiguration.SendTraceEvents, default on). Dropped + // before the sequence counter advances, so suppression leaves no gaps in the + // per-session sequence and the timeline stays contiguous. Evaluated per event + // rather than captured at construction: remote config is merged into the live + // AgentConfiguration mid-session, and the gate must follow it. + if (evt.Severity == EventSeverity.Trace && !TraceEventsEnabled()) + { + return null; + } + evt.Sequence = _sequenceCounter.Next(); if (string.IsNullOrEmpty(evt.SessionId)) evt.SessionId = _sessionId; if (string.IsNullOrEmpty(evt.TenantId)) evt.TenantId = _tenantId; @@ -77,5 +94,23 @@ namespace AutopilotMonitor.Agent.V2.Core.Telemetry.Events return _transport.Enqueue(draft); } + + /// + /// Fail-open: no gate wired (legacy ctor / tests) or a throwing accessor means trace + /// events flow. The gate suppresses diagnostics, so a broken accessor must not be able + /// to silently blind the timeline. + /// + private bool TraceEventsEnabled() + { + if (_traceEventsEnabled == null) return true; + try + { + return _traceEventsEnabled(); + } + catch + { + return true; + } + } } } diff --git a/src/Agent/AutopilotMonitor.Agent.V2/Runtime/AgentRuntimeHost.cs b/src/Agent/AutopilotMonitor.Agent.V2/Runtime/AgentRuntimeHost.cs index 6f5c32f6..49f06782 100644 --- a/src/Agent/AutopilotMonitor.Agent.V2/Runtime/AgentRuntimeHost.cs +++ b/src/Agent/AutopilotMonitor.Agent.V2/Runtime/AgentRuntimeHost.cs @@ -132,7 +132,10 @@ namespace AutopilotMonitor.Agent.V2.Runtime whiteGloveSealingPatternIds: whiteGloveSealingPatternIds, drainInterval: drainInterval, agentMaxLifetime: agentMaxLifetime, - uploadBatchSize: uploadBatchSize)) + uploadBatchSize: uploadBatchSize, + // Live read: remote config is merged into agentConfig mid-session, so the + // trace-event gate must follow it rather than snapshot at construction. + traceEventsEnabled: () => agentConfig.SendTraceEvents)) { using (var shutdown = new ManualResetEventSlim(false)) using (var shutdownComplete = new ManualResetEventSlim(false)) diff --git a/src/Web/autopilot-monitor-web/app/about/page.tsx b/src/Web/autopilot-monitor-web/app/about/page.tsx index 3aa56fd6..4e6feb31 100644 --- a/src/Web/autopilot-monitor-web/app/about/page.tsx +++ b/src/Web/autopilot-monitor-web/app/about/page.tsx @@ -249,11 +249,17 @@ export default function AboutPage() { extended by the wider Windows Autopilot community.

- Autopilot Monitor was created by{" "} + Autopilot Monitor was created and is maintained by{" "} Oliver Kieselbach, a Microsoft MVP and long-time contributor to the Windows Autopilot and Microsoft Intune community. The project is driven by real-world enterprise deployment experience and community feedback.

+

+ The hosted service is operated by glueckkanja AG — see the{" "} + Imprint for company + details and the Terms of Use{" "} + for what each plan does and does not commit to. +

@@ -847,7 +848,7 @@ export default function LandingPage() {

© 2026 Autopilot Monitor. Built with ❤️ by Oliver Kieselbach.{" "} - Powered by Azure. + Hosted on Azure by glueckkanja AG.

Open source. Star us on{' '} diff --git a/src/Web/autopilot-monitor-web/app/privacy/page.tsx b/src/Web/autopilot-monitor-web/app/privacy/page.tsx index c83b850f..263c687d 100644 --- a/src/Web/autopilot-monitor-web/app/privacy/page.tsx +++ b/src/Web/autopilot-monitor-web/app/privacy/page.tsx @@ -1,96 +1,212 @@ import { PublicPageHeader } from "../../components/PublicPageHeader"; +const LAST_UPDATED = "21 July 2026"; +const DOCS_SECURITY_FAQ = "https://docs.autopilotmonitor.com/trust/security-faq"; +const DOCS_SUBPROCESSORS = "https://docs.autopilotmonitor.com/trust/subprocessors"; + +function DocsLink({ href, children }: { href: string; children: React.ReactNode }) { + return ( + + {children} + + ); +} + export default function PrivacyPage() { return (

-

Data Collection

+

Last updated: {LAST_UPDATED}

- This service collects and processes the following data to provide monitoring functionality: -

-
    -
  • Device hardware information (manufacturer, model, serial number)
    • -
  • Autopilot provisioning session data (status, events, timestamps)
    • -
  • Azure AD/Entra ID tenant information
    • -
  • User authentication information (UPN, display name, tenant ID)
    • -
  • Operational telemetry and audit logs
    • -
  • Anonymized usage telemetry (via Azure Application Insights, no cookies) — used to understand which features are used and improve the service. No personal data is transmitted.
    • -
- -

Data Processing Context

-

- During an Autopilot enrollment, the user authenticates solely to verify their identity and initiate the process. - After that, the user is not actively interacting with the device while provisioning runs. As a result, the data - collected by the monitoring agent consists exclusively of technical enrollment events — no user - activity, browsing data, or personal content is captured. -

-

- Tenant administrators retain full control over collected data through the following options: -

-
    -
  • Data Retention — configurable retention period per tenant (default 90 days); expired sessions are automatically purged
    • -
  • Delete Session — delete individual monitoring sessions on demand
    • -
  • Offboard Tenant — remove all data and configurations for a tenant from the service
    • -
-

- These controls ensure that no personal information accumulates in the backend beyond what is necessary for - enrollment monitoring. The service is designed for operational transparency, not user surveillance. + Autopilot Monitor collects technical telemetry about Windows Autopilot enrollments so that IT teams can see + what happened during a device provisioning and why it failed. This policy explains what is collected, where it + is stored, who can reach it, and how long it is kept. The technical detail behind every statement here is + published in the Security & Privacy FAQ.

-

Data Storage & Security

+

Roles: Who Is Responsible for What

- The platform is built with a layered security architecture designed to protect data at every level: + For enrollment telemetry, your organization is the controller and Autopilot Monitor acts as your + processor. You decide which devices are monitored, what additional data your gather rules collect, + how long it is retained, and when it is deleted. +

+

+ For operating the service itself — administrator accounts, the audit trail of portal actions, and operational + telemetry — glueckkanja AG is the controller. +

+

+ glueckkanja AG, a German company certified to ISO/IEC 27001, operates Autopilot Monitor for{" "} + both plans — the same service, the same infrastructure, the same protection measures. Company + details are in the Imprint. + The project is maintained by Oliver Kieselbach, who acts in that role on behalf of glueckkanja AG and is the + contact for the open-source project and the Community edition. +

+

+ A data processing agreement (DPA / AVV) is available on request, concluded with + glueckkanja AG. On the Enterprise plan it forms part of the written agreement.

-

Authentication & Device Identity

+

What We Collect

+

From enrolling devices

    -
  • Device agents authenticate via Intune MDM client certificates, validated against the embedded Intune CA chain
    • -
  • Web users authenticate via Microsoft Entra ID (Azure AD) with multi-tenant JWT validation
    • -
  • Autopilot device validation via Microsoft Graph — only registered Autopilot devices are accepted
    • -
  • Optional hardware whitelist for additional device verification
    • -
  • Per-device rate limiting (sliding window) to prevent abuse
    • +
  • Device identity — serial number, device name, manufacturer, model, and the Entra ID tenant the device enrolls into
    • +
  • Enrollment progress — phases, ESP stages, application and script results, policy activity, reboots, timings, and failure codes
    • +
  • Device context — OS build, hardware characteristics, disk and network state, plus whatever your own gather rules request
    • +
  • Approximate location — country, region, city, and approximate coordinates, if geolocation is enabled for your tenant
-

Tenant Isolation

+

From portal users

    -
  • Strict multi-tenant data isolation — all storage queries are partitioned by Tenant ID
    • -
  • Real-time channels (SignalR) are scoped to tenant-specific groups
    • -
  • Independent configuration, audit logs, and device management per tenant
    • +
  • Sign-in identity from Microsoft Entra ID — user principal name, display name, and tenant ID
    • +
  • Audit records of administrative actions, including who performed them and when
    • +
  • Operational request telemetry used to run and support the service
-

Transport & Data Protection

-
    -
  • All communication encrypted via HTTPS/TLS; real-time updates via secure WebSocket
    • -
  • Diagnostics upload URLs are issued on-demand, and never persisted on the device
    • -
  • Azure Storage encryption at rest for all persisted data
    • -
  • PII logging disabled in production environments
    • -
- -

Access Control

-
    -
  • Role-based access: Tenant Admin (full tenant management), Operator, Users
    • -
  • Device blocking capabilities for compromised or unauthorized devices
    • -
  • Comprehensive audit logging of administrative actions
    • -
- -

Data Sharing

+

What We Do Not Collect

- Your data is not shared with third parties. Access is restricted to: + During Autopilot provisioning the user signs in once to start the process and then does not interact with the + device while it provisions. The agent captures no browsing history, no file or document content, no + keystrokes, no screen content, and no application usage tracking. It removes itself when enrollment + finishes. The service is designed for operational transparency, not user surveillance. +

+

+ Gather rules cannot be used to widen this: C:\Users{" "} + is always blocked for privacy reasons, and downloading files, creating users, manipulating boot configuration, + and establishing persistence are hard-blocked and cannot be enabled by configuration. +

+ +

IP Addresses and Geolocation

+

+ Geolocation is a tenant setting and is enabled by default. While it is enabled:

    -
  • Authenticated users within your tenant
    • -
  • Global Administrators (for platform operations and support)
    • +
  • The session record stores only the derived location — country, region, city, and approximate coordinates. The IP is deliberately excluded from the location event shown in the timeline.
    • +
  • The outbound public IP is additionally stored once per session as a separate diagnostic event. It is hidden from the timeline view by default, but it is retained and queryable, and it expires with your retention period like any other event.
    • +
  • Service request telemetry does not carry device IP addresses; the platform masks them and the application never sets them.
    • +
  • A source IP is also stored on distress reports — the emergency channel an agent uses to report that it is failing — as part of that incident record.
    • +
+

+ Disabling geolocation stops all of this — no IP and no location data is collected. It is a + tenant setting and also an agent command-line switch. Only the Geographic Performance view is affected. +

+ +

Where Your Data Is Stored

+

+ All customer data — sessions, events, configuration, audit logs, diagnostics, and backups — is stored in + Microsoft Azure in Germany West Central. The only component outside that region is the portal + front-end, served as static assets from West Europe; it stores no customer data. There is no cross-region + replication and no transfer of customer data outside the EU by the platform. +

+ +

Who Can Access Your Data

+

+ Your data is not sold, and it is not shared with third parties for their own purposes. Access is limited to: +

+
    +
  • Authenticated users in your own tenant, according to their role — Admin, Operator, Viewer, or a role-less Member limited to the Progress Portal
    • +
  • Platform operators — Global Admin for operations and support, and Global Reader for read-only support with configuration secrets redacted
    • +
  • Delegated (MSP) administrators you or your provider have been granted — read-only, limited to exactly the tenants in scope, with configuration secrets redacted, and with every grant and revocation written to your tenant's audit log so you can always see who was given access to your data
    • +
+

+ Delegated administration is an Enterprise capability and is off unless explicitly granted. Full detail on the + isolation model is in the Security & Privacy FAQ. +

+ +

Sub-processors and Outbound Data Flows

+

+ Microsoft Azure is the only sub-processor that stores your data. Resend is used solely to + deliver the onboarding approval email when a tenant is activated — it receives an administrator's email + address and the tenant domain, never enrollment telemetry. Vulnerability reference data is pulled inbound from + NVD, the CISA KEV catalog, and MSRC; no customer data is sent to them. +

+

+ Some data flows exist only because you configure them: your own Azure storage account for diagnostics, + notification channels such as Teams, Slack, or a generic webhook, and your own AI assistant if a user connects + one through the MCP integration. The platform itself makes no calls to any AI or LLM provider. The complete + list is published as Sub-processors, and new sub-processors are + announced there before they are introduced. +

+ +

Diagnostics Uploads

+

+ Diagnostics upload is off by default. When enabled, the default destination is{" "} + your own Azure storage account — the package never reaches our infrastructure. Hosted upload + exists as an alternative but is opt-in only and requires an explicit administrator action behind a clearly + marked disclosure that data leaves your tenant. It is never enabled silently. +

+ +

How Long We Keep Data

+

+ Retention is configured by you per tenant, defaulting to 90 days — 7 to 90 days on the + Community plan and 7 to 365 days on Enterprise. Expired sessions are purged automatically. You additionally + control: +

+
    +
  • Delete session — remove an individual monitoring session on demand
    • +
  • Offboard tenant — remove your tenant's data and configuration from the service entirely, as a verified multi-phase cascade
    • +
+

+ Two things intentionally survive tenant offboarding, neither of which contains enrollment telemetry or + personal data: +

+
    +
  • Product feedback you submitted — it is not tied to enrollment data and is what improves the product.
    • +
  • Custom rules and IME log patterns you authored are archived rather than deleted. Detection knowledge is what makes this product useful, so contributed rules and patterns are subject to entering the community pool — the next organization hitting the same enrollment failure gets a diagnosis instead of a mystery. A rule is a detection definition, not device data.
    • +
+

+ Either can be removed on request. +

+ +

How Your Data Is Protected

+
    +
  • Device authentication by mutual TLS using the Intune MDM client certificate, validated against pinned Intune root CAs rather than the operating system trust store — and rejected if no trust anchor loads
    • +
  • Autopilot device validation via Microsoft Graph — only devices registered in your tenant are accepted, with an optional hardware allow-list on top
    • +
  • Entra ID authentication for portal users with a restricted signing-algorithm allow-list and identity PII logging disabled
    • +
  • Fail-closed authorization — every API route must be registered with an access policy; an unregistered route is unreachable
    • +
  • Structural tenant isolation — storage partitioning by tenant, with the tenant identity taken from the validated token and never from a client-supplied header
    • +
  • Encryption — HTTPS with a TLS 1.2 floor in transit, Azure Storage encryption at rest with platform-managed keys
    • +
  • Managed identity instead of storage keys, and secret-less OIDC deployment pipelines
    • +
  • Rate limiting per device, per portal user, and per MCP user
    • +
  • Verifiable agent binaries — Sigstore build attestation plus a four-stage integrity chain through download, backend cross-check, and runtime self-verification
    • +
  • Manifest-first deletion — what will be deleted is captured, restorably, before anything is removed

Your Rights

- As this is an environment operated under best-effort principles, formal data subject rights (access, deletion, portability) - are not guaranteed. However, we will make reasonable efforts to accommodate such requests on a case-by-case basis. + Where the GDPR applies, you have the right to access, correction, deletion, restriction of processing, + portability, and to object to processing. We act on such requests within the statutory time limits. In + practice most requests resolve immediately in the portal, because deletion of individual sessions, full tenant + offboarding, and the retention period are all controls you hold yourself. +

+

+ Where Autopilot Monitor acts as your processor, requests from your own employees should be directed to your + organization; we support you in fulfilling them. +

+ +

Changes to This Policy

+

+ Material changes are reflected in the "last updated" date above and announced through the service + announcements in the portal. If you hold a signed data processing agreement, notification follows the terms of + that agreement. +

+ +

Contact

+

+ For privacy questions, a data processing agreement, or a data subject request, contact glueckkanja AG using + the details in the Imprint. + For the open-source project and the Community edition you can also reach the maintainer via{" "} + LinkedIn{" "} + or open a{" "} + GitHub issue.

-
); diff --git a/src/Web/autopilot-monitor-web/app/terms/page.tsx b/src/Web/autopilot-monitor-web/app/terms/page.tsx index b9f1c974..daca2bc6 100644 --- a/src/Web/autopilot-monitor-web/app/terms/page.tsx +++ b/src/Web/autopilot-monitor-web/app/terms/page.tsx @@ -1,47 +1,142 @@ import { PublicPageHeader } from "../../components/PublicPageHeader"; +const LAST_UPDATED = "21 July 2026"; +const DOCS_SECURITY_FAQ = "https://docs.autopilotmonitor.com/trust/security-faq"; +const DOCS_PLANS = "https://docs.autopilotmonitor.com/plans"; + export default function TermsPage() { return (
+

Last updated: {LAST_UPDATED}

- By using this service, you agree to the following terms: + Autopilot Monitor is provided by glueckkanja AG, a German company certified to ISO/IEC + 27001 — see the Imprint. + Both plans run on the same service and the same infrastructure; the plan determines operating limits, + support, and contractual commitments, not how the service works. +

+

+ The project was created and is maintained by Oliver Kieselbach, who is also the contact for + the open-source project and the Community edition. He acts in that role on behalf of glueckkanja AG; he is + not a separate contracting party. +

+ +
+
+

Community

+

+ Free, invite-only, currently in Private Preview, and maintained by Oliver Kieselbach as an open + community contribution. Provided without any commitment by glueckkanja AG as to + availability, support, or fitness for a particular purpose. Support is community-based via GitHub. +

+
+
+

Enterprise

+

+ Commercial plan under a written agreement with glueckkanja AG. Includes support and reliability + commitments, a data processing agreement, higher operating limits, extended retention, and delegated + (MSP) administration. Where that agreement differs from these terms, the agreement prevails. +

+
+
+

+ The sections below apply to both plans unless stated otherwise. Plan details are documented under{" "} + Plans. +

+ +
+

+ Business use only. Autopilot Monitor is offered exclusively to businesses and + organizations acting in a commercial or professional capacity. It is not offered to consumers. +

+
+
+ +
+

Acceptable Use

+

By using this service, you agree that:

+
    +
  • The service is used to monitor and troubleshoot Windows Autopilot deployments for devices your organization is entitled to manage.
    • +
  • You are responsible for ensuring your use complies with your organization's policies, your works council or employee representation obligations, and applicable law — including informing your users about monitoring where required.
    • +
  • Access requires authentication via Microsoft Entra ID, and each tenant's data is accessible only to authorized users of that tenant, or to parties you have granted delegated access.
    • +
  • You will not attempt to access another tenant's data, circumvent security controls, or probe the service for vulnerabilities without prior written agreement.
    • +
  • You will not use gather rules or any other configuration to collect data unrelated to enrollment diagnostics, or to monitor individual employees.
    • +
  • You will not use the service to build a competing product, or resell access without an agreement permitting it.
    • +
  • Automated access, including through the MCP integration, stays within the published rate limits and quotas.
    • +
+

+ Responsible disclosure of a security issue is welcome and will not be treated as a violation — report it + privately rather than publicly. +

+
+ +
+

Delegated (MSP) Administration

+

+ Delegated administration lets a managing organization see a defined set of customer tenants from one place. It + is an Enterprise capability and applies only where access has been granted.

    -
  • This service is provided for monitoring and troubleshooting Windows Autopilot deployments in your organization.
    • -
  • You are responsible for ensuring that your use of this service complies with your organization's policies and applicable laws.
    • -
  • Access to this service requires proper authentication via Azure AD/Entra ID.
    • -
  • Each tenant's data is isolated and accessible only to authorized users of that tenant.
    • -
  • You must not attempt to access data belonging to other tenants or circumvent security measures.
    • -
  • The service operator reserves the right to suspend or terminate access at any time without prior notice.
    • +
  • Delegated access is read-only and limited to exactly the tenants in scope. Configuration secrets are redacted.
    • +
  • A grant is either assigned by platform operators or delegated by the customer's own tenant admin; customer-initiated delegations require approval before they take effect.
    • +
  • Every grant, revocation, and disablement is recorded in the managed customer tenant's audit log, so a customer can always determine who holds access to their data.
    • +
  • A managing organization acts as a processor or sub-processor of its customers and is responsible for having the necessary agreements in place with them.
    • +
  • Access can be revoked at any time by the customer or by platform operators and takes effect within seconds.
-

Legal Disclaimer

+

Availability, Support and Data

+
-

AS-IS, No Warranty

+

Community plan: provided "AS-IS", no warranty

- This software is provided "AS-IS" without any warranty of any kind, either expressed or implied, - including but not limited to the implied warranties of merchantability and fitness for a particular purpose. + The Community plan is provided free of charge, "AS-IS", and without warranty of any kind, express + or implied, including the implied warranties of merchantability and fitness for a particular purpose. It is + currently in Private Preview: updates are frequent, availability is not guaranteed, and data structures may + change. Production use is permitted and intended — with that trade-off understood.

+
-

No Liability: The service operator shall not be liable for any damages, including but not limited to direct, indirect, incidental, special, consequential, or punitive damages arising out of the use or inability to use this service.

-

No Service Level Agreement (SLA): This service is provided without any guaranteed uptime or availability. Service interruptions, maintenance windows, or complete shutdown may occur without prior notice.

-

No Data Backup Guarantee: While we implement data retention policies, we do not guarantee the preservation of your data. You are responsible for maintaining your own backups and records.

-

Best Effort Support: Support is provided on a best-effort basis with no guaranteed response times or resolution commitments.

-

Use at Your Own Risk: By using this service, you acknowledge that you do so at your own risk and that you are solely responsible for any consequences arising from your use of the service.

-

Active Development Notice: This project is under active development. Service interruptions or unexpected behavior can occur at any time, especially when updates are deployed to the backend, web application, or agent components.

+

Availability. The Community plan carries no uptime or availability commitment; interruptions, maintenance, and changes can occur without prior notice. The Enterprise plan carries the availability commitments set out in its agreement.

+

Support. Community support is best-effort via GitHub issues, provided by the project maintainer and the community, with no guaranteed response or resolution time; built-in rules and IME log patterns are community-maintained. Enterprise support follows the response commitments in its agreement.

+

Data durability. Autopilot Monitor is a monitoring system, not a system of record. Configuration, authorization, and rule data is backed up daily; session and event telemetry is time-bounded operational data and is not backed up. Retain anything you need for compliance or reporting purposes in your own systems.

+

Liability. To the extent permitted by law, glueckkanja AG is not liable for indirect, incidental, special, consequential, or punitive damages, or for loss of data, profit, or business, arising from use of or inability to use the service. For the Community plan, which is provided free of charge, liability is limited to intent and gross negligence. Liability for injury to life, body or health and under mandatory statutory provisions remains unaffected. For the Enterprise plan, the liability provisions of the written agreement apply.

+

Use at your own risk. The service reports on enrollments; it does not perform them. Operational decisions you take based on its output remain your responsibility.

-

Third-Party Data Sources & Attributions

+

Your Data, Suspension and Termination

+
+

Ownership. Your enrollment telemetry remains yours. Autopilot Monitor processes it to provide the service, as described in the Privacy Policy.

+

Your controls. You set the retention period, delete individual sessions, and offboard your tenant entirely at any time — no support ticket required.

+

Rules you contribute. Analyze rules, gather rules, and IME log patterns you author are detection definitions, not device data. By creating them you grant a non-exclusive, royalty-free right to retain them and to include them in the shared community rule pool, so that other organizations can benefit from a detection you built. This is the reciprocal side of a product whose built-in rules are community-maintained. You keep the right to use your own rules however you like, and you can request removal from the pool at any time.

+

Suspension. Access may be suspended where use threatens the integrity, security, or availability of the service or of other tenants — for example abusive request volumes or attempts to reach other tenants' data. Where circumstances permit, notice is given first.

+

Termination. You may stop using the service and offboard at any time. For the Community plan, the operator may discontinue the service or an individual tenant's access; reasonable advance notice will be given except where security requires immediate action. Enterprise termination follows its agreement.

+

After offboarding. Your tenant's data is removed through a verified multi-phase cascade. Product feedback you submitted, and custom rules and IME log patterns you authored, are intentionally retained — neither contains enrollment telemetry or personal data. Both are removed on request.

+
+
+ +
+

Security and Transparency

- The vulnerability correlation feature uses the following external data sources to identify known vulnerabilities in installed software: + The security architecture, data residency, sub-processors, retention and deletion behaviour, and an explicit + statement of what the service does not do are published in the{" "} + Security & Privacy FAQ. + A signed data processing agreement is part of the Enterprise plan. +

+
+ +
+

Third-Party Data Sources & Attributions

+

+ The vulnerability correlation feature uses the following external data sources to identify known + vulnerabilities in installed software. These are inbound reference-data pulls — no customer data is sent to + them.

@@ -71,6 +166,15 @@ export default function TermsPage() {
+
+

Changes and Governing Law

+
+

Changes. These terms may be updated; the "last updated" date above reflects the current version, and material changes are announced through the service announcements in the portal. Continued use after a change constitutes acceptance.

+

Governing law. These terms are governed by German law. For the Enterprise plan, the governing-law and venue provisions of the written agreement apply.

+

Severability. If a provision is found unenforceable, the remaining provisions stay in effect.

+

Contact. Company details are in the Imprint. For the project and the Community edition, reach the maintainer via LinkedIn or open a GitHub issue.

+
+
); diff --git a/src/Web/autopilot-monitor-web/components/Navbar.tsx b/src/Web/autopilot-monitor-web/components/Navbar.tsx index decb1e4f..fde31143 100644 --- a/src/Web/autopilot-monitor-web/components/Navbar.tsx +++ b/src/Web/autopilot-monitor-web/components/Navbar.tsx @@ -536,6 +536,19 @@ export default function Navbar() { Terms of Use + + setShowHelp(false)} + > + + + + Imprint +
)} @@ -700,6 +713,10 @@ export default function Navbar() { Terms of Use + { setShowOverflow(false); setOverflowSubmenu(null); }}> + + Imprint + )}