feat(agent,web,shared): phase_exit gather trigger — one-shot collection at a phase's end

Follow-up to gather-rule phase scoping. One-shot collection at a phase START
already existed (phase_change dedups per (rule, phase)) and at enrollment END
(on_event + enrollment_complete); the END of a specific phase had no trigger.

New trigger value "phase_exit": fires once when TriggerPhase is LEFT (empty =
every phase transition). Together with phase_change it forms the two one-shot
bookends of a phase.

Agent (GatherRuleExecutor.OnPhaseChanged):
- Exit rules are evaluated BEFORE _currentPhase advances, so both the
  TriggerPhase match and the phase-scope gate see the phase being LEFT. A rule
  scoped to DeviceSetup therefore fires on its own exit even though the phase
  being entered is out of scope.
- A transition into Failed fires the exit rules of the failing phase — the
  snapshot at a failure boundary is the point of the trigger.
- Exit of Unknown never fires; a repeated identical phase signal is not a
  transition.
- Dedup key "exit:{ruleId}|{phase}" shares _phaseRulesExecuted with the
  phase_change keys but stays in a disjoint key space, so an enter-rule and an
  exit-rule on the same phase cannot consume each other's slot.

Portal: trigger labels are now "Phase Start" / "Phase End"; the canonical phase
dropdown and the create/save payloads cover both via PHASE_TRIGGERS; the card
renders "entering X" / "leaving X".

No ConfigVersion bump: no new field is transported. Old agents do not know the
value and simply never fire the rule (silent no-op).

Tests: GatherRuleExecutorPhaseExitTests (11) — enter-vs-exit, no refire on
re-entry, empty-triggerPhase, exit-of-Unknown, same-phase-signal, into-Failed,
Complete, scope-against-left-phase, out-of-scope slot preservation, key-space
disjointness, on_change interplay. Build 0 Errors; V2.Core.Tests 1884/1884;
Functions.Tests 3099/3099; vitest 557/557; tsc silent.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.claude/CLAUDE.md

@@ -1,79 +1,37 @@
-## Workflow Orchestration
-# Agent Directives: Mechanical Overrides
+# Agent Directives
 
-You are operating within a constrained context window and strict system prompts. To produce production-grade code, you MUST adhere to these overrides:
+- **Plan first.** Enter plan mode for any non-trivial task (3+ steps or an architectural decision) and write the spec before building. If something goes sideways, stop and re-plan instead of pushing on.
+- **Use subagents liberally** for research, exploration, and parallel analysis — one focus each — to keep the main context clean.
+- **Verify before claiming done.** Run the tests, check the logs, show the evidence. Diff against `main` where behaviour could regress.
+- **Fix bugs autonomously.** Given a report, a failing test, or an error, resolve it — no hand-holding.
+- **Capture corrections.** After any correction from the user, record the pattern and a preventing rule in `tasks/lessons.md`; review it at session start.
+- Read files over 500 LOC in chunks. Never treat one grep as proof of absence.
 
+Codex reviews your output once you are done.
 
+## Code Quality
 
-### 1. Plan Mode Default
-- Enter plan mode for ANY non-trivial task (3+ steps or architectural decisions)
-- If something goes sideways, STOP and re-plan immediately — don't keep pushing
-- Use plan mode for specification steps, not just building
-- Write detailed specs upfront to reduce ambiguity
-
-### 2. Subagent Strategy
-- Use subagents liberally to keep main context window clean
-- Offload research, exploration, and parallel analysis to subagents
-- For complex problems, throw more compute at it via subagents
-- One tack per subagent for focused execution
-
-### 3. Self-Improvement Loop
-- After ANY correction from the user: update `tasks/lessons.md` with the pattern
-- Write rules for yourself that prevent the same mistake
-- Ruthlessly iterate on these lessons until mistake rate drops
-- Review lessons at session start for relevant project
-
-### 4. Verification Before Done
-- Never mark a task complete without proving it works
-- Diff behavior between main and your changes when relevant
-- Ask yourself: "Would a staff engineer approve this?"
-- Run tests, check logs, demonstrate correctness
-
-### 5. Demand Elegance (Balanced)
-- For non-trivial changes: pause and ask "is there a more elegant way?"
-- If a fix feels hacky: "Knowing everything I know now, implement the elegant solution"
-- Skip this for simple, obvious fixes — don't over-engineer
-- Challenge your own work before presenting it
-
-### 6. Autonomous Bug Fixing
-- When given a bug report: just fix it. Don't ask for hand-holding
-- Point at logs, errors, failing tests — then resolve them
-- Zero context switching required from the user
-- Go fix failing CI tests without being told how
-
-
-
-### Tools Execution
-- Read any file over 500 LOC in chunks using offset and limit parameters.
-- Do not assume a single grep caught everything.
-
-### Code Quality
-- If architecture is flawed, state is duplicated, or patterns are inconsistent - propose and implement structural fixes. Ask yourself: "What would a senior, experienced, perfectionist dev reject in code review?" Fix all of it.
-
-
-Codex will review your output once you are done!
-
+- Simplicity first: minimal, targeted changes. No temporary fixes — find the root cause.
+- Where architecture is flawed, state is duplicated, or patterns are inconsistent, propose and implement the structural fix. Ask what a perfectionist reviewer would reject, and fix that too.
+- On non-trivial changes, ask whether there is a more elegant way before presenting. Skip it for simple fixes — don't over-engineer.
 
 ## Task Management
 
-1. **Plan First**: Write plan to `tasks/todo.md` with checkable items
-2. **Verify Plan**: Check in before starting implementation
-3. **Track Progress**: Mark items complete as you go
-4. **Explain Changes**: High-level summary at each step
-5. **Document Results**: Add review section to `tasks/todo.md`
-6. **Capture Lessons**: Update `tasks/lessons.md` after corrections
+Keep the plan in `tasks/todo.md` as checkable items, confirm it before implementing, tick items off as you go, and add a review section when done.
 
-## Core Principles
+## Customer-Facing Claims
 
-- **Simplicity First**: Make every change as simple as possible. Impact minimal code.
-- **No Laziness**: Find root causes. No temporary fixes. Senior developer standards.
-- **Minimal Impact**: Changes should only touch what's necessary. Avoid introducing bugs.
+`src/Web/autopilot-monitor-web/app/{about,terms,privacy}/page.tsx` and `autopilotmonitor-docs/trust/*` state facts customers and security reviewers rely on. They drift silently.
 
-## Technical Docs — OKF Knowledge Bundle (`docs/`)
+- Verify every claim against the code before writing it — never carry one forward because it was already on the page.
+- Update them in the same change as: runtime/framework versions, roles, notification providers, agent deployment or lifecycle, diagnostics payload, isolation/delegation model, retention caps, sub-processors, or any default governing what is collected.
+- Describe only what customers can actually use; operator-only infrastructure is not a feature.
+- Trust pages: durable phrasing over exact figures, and bump their "Last reviewed" date.
 
-`docs/` is an [Open Knowledge Format (OKF) v0.1](https://github.com/GoogleCloudPlatform/knowledge-catalog/blob/main/okf/SPEC.md) knowledge bundle for contributor/AI-facing technical documentation (customer docs live in the separate autopilotmonitor-docs repo).
+## Technical Docs — OKF Bundle (`docs/`)
 
-- **Consume first**: start at `docs/index.md` for progressive disclosure before opening individual documents.
-- **When new durable technical knowledge emerges** (architecture decisions, flows, non-obvious mechanisms), capture it as an OKF concept document in `docs/` — markdown with YAML frontmatter: `type` (mandatory), plus `title`, `description`, `resource`, `tags`, `timestamp` (recommended).
-- **Maintain the bundle**: add every new document to `docs/index.md`, note changes in `docs/log.md` (grouped by ISO date). Use standard RELATIVE markdown links between docs — never the OKF `/`-prefixed bundle-absolute form (GitHub resolves those from the repo root and navigation breaks). `index.md` and `log.md` are reserved filenames.
-- Documents are English, structural markdown over prose (`# Schema`, `# Examples`, `# Citations` sections where applicable).
+Contributor/AI-facing docs (customer docs live in the `autopilotmonitor-docs` repo). Start at `docs/index.md` before opening individual files.
+
+- New durable knowledge (architecture decisions, flows, non-obvious mechanisms) → an OKF concept doc with YAML frontmatter: `type` (mandatory), plus `title`, `description`, `resource`, `tags`, `timestamp`.
+- Register it in `docs/index.md`, note the change in `docs/log.md` (ISO date). `index.md` and `log.md` are reserved names.
+- English, structural markdown (`# Schema`, `# Examples`, `# Citations`). Links between docs are RELATIVE — never `/`-prefixed, that breaks GitHub navigation.

README.md

@@ -34,7 +34,7 @@ For detailed information about the system architecture, components, and data flo
 
 ## Documentation
 
-Full documentation is available at **[autopilotmonitor.com/docs](https://www.autopilotmonitor.com/docs)**
+Full admin documentation is available at **[docs.autopilotmonitor.com](https://docs.autopilotmonitor.com)**
 
 ## License
 

docs/index.md

@@ -22,7 +22,7 @@ https://docs.autopilotmonitor.com (separate repository).
 
 # Rules
 
-* [Gather Rule Phase Scoping & Emit-on-Change](rules/gather-rule-phase-scoping.md) - Restricting gather rules to enrollment phases (activePhases / activeFromPhase sticky latch) and emitMode "on_change" result-dedup — the anti-spam pair for interval rules.
+* [Gather Rule Phase Scoping, One-Shot Triggers & Emit-on-Change](rules/gather-rule-phase-scoping.md) - Restricting gather rules to enrollment phases (activePhases / activeFromPhase sticky latch), one-shot collection at a phase's start/end (phase_change / phase_exit), and emitMode "on_change" result-dedup.
 
 # Backend
 

docs/log.md

@@ -2,6 +2,7 @@
 
 ## 2026-07-20
 
+* **Update**: Extended `rules/gather-rule-phase-scoping.md` with the `phase_exit` trigger — the closing bookend to `phase_change`, for one-shot collection when a phase is LEFT (e.g. "state at the end of Account Setup"). Documents the evaluation-before-phase-advance rule (triggerPhase match and scope gate see the phase being left), firing into `Failed`, the disjoint `exit:` dedup key space, and why no ConfigVersion bump is needed (no new field — old agents simply never fire the rule).
 * **Update**: Reworked `agent/mdm-reboot-coalescing.md` after the first real enrollment (session b2e890c1): 2800 records are now **aggregated per burst** into ONE neutral Info event (`rebootUris[]`/`uriCount`/`firstRebootUri`; watermark persisted at flush so a pre-emit reboot kill loses nothing); the raw event no longer claims a reboot — ANALYZE-ESP-005 is gated on an actually-observed `system_reboot_detected`. **Removed** the Shell-Core `esp_reboot_coalescing` event entirely: the "RebootCoalescing" token appears in the routine `SubcategoryProcessing_Started` bootstrap marker on every enrollment (false positive by construction). Verified 2800 description shape recorded.
 * **Creation**: Added `agent/mdm-reboot-coalescing.md` — the agent now attributes the "unexpected mid-ESP reboot + second sign-in" pattern (PMPC research) to the device-assigned policy URIs that forced it: new `MdmRebootPolicyTracker` (DM-Enterprise EventID 2800, per-URI `mdm_policy_reboot_required` events, cross-restart RecordId watermark), a `RebootCoalescing` branch in `ShellCoreTracker` (`esp_reboot_coalescing`, backfill-emitting by design), and the `ANALYZE-ESP-005` advisory (reassign device → user groups). ConfigVersion 35; event types deliberately distinct from `system_reboot_detected` so RebootCount stays uninflated.
 

docs/rules/gather-rule-phase-scoping.md

@@ -1,7 +1,7 @@
 ---
 type: Concept
-title: Gather Rule Phase Scoping & Emit-on-Change
-description: How gather rules are restricted to enrollment phases (activePhases / activeFromPhase) and how emitMode "on_change" suppresses repeated identical results — the anti-spam pair for interval rules.
+title: Gather Rule Phase Scoping, One-Shot Triggers & Emit-on-Change
+description: How gather rules are restricted to enrollment phases (activePhases / activeFromPhase), collect once at a phase boundary (phase_change / phase_exit), and how emitMode "on_change" suppresses repeated identical results.
 resource: /src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Telemetry/Gather/GatherRuleExecutor.cs
 tags:
   - agent
@@ -35,6 +35,35 @@ Backend validation (`GatherRulesFunction.ValidateScopeAndEmitMode`) rejects `Unk
 numeric tokens, unknown emit modes, and both scope fields set at once (400). The agent
 defensively prefers `activePhases` if both arrive anyway.
 
+# One-shot collection at phase boundaries
+
+Scoping answers "while *may* this rule run". The trigger answers "when does it fire". For
+one-shot collection the two phase triggers are the bookends of a phase:
+
+| Trigger | Fires |
+|---|---|
+| `phase_change` | Once when `triggerPhase` is **entered** (dedup key `{ruleId}\|{phase}`). |
+| `phase_exit` | Once when `triggerPhase` is **left** (dedup key `exit:{ruleId}\|{phase}`). |
+
+Empty `triggerPhase` means every transition. Both keys live in the same
+`_phaseRulesExecuted` set; the `exit:` prefix keeps the two key spaces disjoint, so an
+enter-rule and an exit-rule on the same phase never cannibalise each other's slot.
+
+`phase_exit` semantics that are easy to get wrong:
+
+* It is evaluated **before** `_currentPhase` advances, so both the `triggerPhase` match and
+  the phase-scope gate see the phase being **left**. A rule scoped to `DeviceSetup` therefore
+  still fires on its own exit, even though the phase being entered is outside that scope.
+* A transition into `Failed` **does** fire the exit rules of the failing phase — capturing
+  state at the failure boundary is the point.
+* Exit of `Unknown` never fires (nothing was entered yet), and a repeated identical phase
+  signal is not a transition.
+* An exit rule on `Complete` only fires if something transitions *away* from Complete. For
+  "at the end of enrollment", use `phase_change` on `Complete` or `on_event` with
+  `enrollment_complete`.
+* Old agents do not know the trigger value and simply never fire the rule (silent no-op) —
+  which is why `phase_exit` needs no ConfigVersion bump: no new field is transported.
+
 # Scope semantics (agent, `GatherRuleExecutor`)
 
 * Scope applies to **all trigger types**:

rules/schema/gather-rule.schema.json

@@ -80,8 +80,8 @@
         },
         "trigger": {
           "type": "string",
-          "description": "When to collect data.",
-          "enum": ["startup", "phase_change", "interval", "on_event"]
+          "description": "When to collect data. \"phase_change\" fires once when triggerPhase is entered, \"phase_exit\" once when it is left.",
+          "enum": ["startup", "phase_change", "phase_exit", "interval", "on_event"]
         },
         "intervalSeconds": {
           "type": "integer",
@@ -90,7 +90,7 @@
         },
         "triggerPhase": {
           "type": "string",
-          "description": "Phase to trigger on (only used when trigger = \"phase_change\")."
+          "description": "Phase to trigger on (used when trigger = \"phase_change\" or \"phase_exit\"). Empty = every phase transition."
         },
         "triggerEventType": {
           "type": "string",

scripts/Bootstrap/Install-AutopilotMonitor-dev.ps1

@@ -56,6 +56,10 @@
       PowerShell 5.1 (IME) reads scripts without BOM as ANSI, corrupting multi-byte chars.
 
 .CHANGELOG
+    2026-07-20  v2.2  Switched default download endpoint from the legacy blob
+                      (autopilotmonitor.blob.core.windows.net) to the Front Door alias
+                      https://download.autopilotmonitor.com/agent/ (route /agent/*).
+                      version.json is still derived from the same container.
     2026-06-25  v2.1  OOBE-relax: detect genuine OOBE via WinRT
                       SystemSetupInfo.OutOfBoxExperienceState and exempt guards 2+3 when a
                       single freshly-created profile appears in OOBE (Windows Backup for
@@ -80,7 +84,7 @@
 [CmdletBinding()]
 param(
     [Parameter(Mandatory = $false)]
-    [string]$AgentDownloadUrl = "https://autopilotmonitor.blob.core.windows.net/agent/AutopilotMonitor-Agent.zip",
+    [string]$AgentDownloadUrl = "https://download.autopilotmonitor.com/agent/AutopilotMonitor-Agent.zip",
 
     [Parameter(Mandatory = $false)]
     [string]$VersionJsonName = "version.json",
@@ -93,7 +97,7 @@ param(
 )
 
 # Script version (bump on meaningful changes; see .CHANGELOG above)
-$ScriptVersion = "2.1"
+$ScriptVersion = "2.2"
 
 # Configuration - Everything in ProgramData for easy cleanup
 $AgentBasePath = "$env:ProgramData\AutopilotMonitor"

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Gather/GatherRuleExecutorPhaseExitTests.cs

@@ -0,0 +1,246 @@
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Threading;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Shared.Models;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Gather
+{
+    /// <summary>
+    /// The <c>phase_exit</c> trigger: a one-shot collection when a phase is LEFT — the closing
+    /// bookend to <c>phase_change</c> (which fires on ENTER). The distinguishing invariant is that
+    /// both the TriggerPhase match and the phase-scope gate must evaluate against the phase being
+    /// left, i.e. before the executor's current-phase state moves forward.
+    /// Rules use the absent-registry-path pattern so no real system state is touched.
+    /// </summary>
+    [Collection("SerialThreading")] // rules execute on the shared ThreadPool
+    public sealed class GatherRuleExecutorPhaseExitTests : IDisposable
+    {
+        private readonly TempDirectory _tmp = new TempDirectory();
+        private readonly List<EnrollmentEvent> _events = new List<EnrollmentEvent>();
+        private readonly object _eventsGate = new object();
+        private readonly GatherRuleExecutor _executor;
+
+        private const string AbsentPath =
+            "HKLM\\SOFTWARE\\AutopilotMonitorTests\\DefinitelyAbsent_9c4d2a7f-0000-0000-0000-000000000000";
+
+        public GatherRuleExecutorPhaseExitTests()
+        {
+            var logger = new AgentLogger(_tmp.Path, AgentLogLevel.Info);
+            _executor = new GatherRuleExecutor(
+                "sess", "tenant",
+                evt => { lock (_eventsGate) _events.Add(evt); },
+                logger)
+            {
+                UnrestrictedMode = true
+            };
+        }
+
+        public void Dispose()
+        {
+            _executor.Dispose();
+            _tmp.Dispose();
+        }
+
+        private int EventCount { get { lock (_eventsGate) return _events.Count; } }
+
+        private bool WaitForEventCount(int count, int timeoutMs = 10000)
+        {
+            var sw = Stopwatch.StartNew();
+            while (sw.ElapsedMilliseconds < timeoutMs)
+            {
+                if (EventCount >= count) return true;
+                Thread.Sleep(25);
+            }
+            return EventCount >= count;
+        }
+
+        private static GatherRule ExitRule(
+            string id, string triggerPhase, List<string> activePhases = null, string fromPhase = null)
+            => new GatherRule
+            {
+                RuleId = id,
+                Title = id,
+                CollectorType = "registry",
+                Target = AbsentPath,
+                Trigger = "phase_exit",
+                TriggerPhase = triggerPhase,
+                OutputEventType = "gather_test",
+                Enabled = true,
+                ActivePhases = activePhases,
+                ActiveFromPhase = fromPhase,
+            };
+
+        [Fact]
+        public void FiresOnceWhenTheNamedPhaseIsLeft_NotWhenItIsEntered()
+        {
+            _executor.UpdateRules(new List<GatherRule> { ExitRule("GATHER-PX-001", "AccountSetup") });
+
+            _executor.OnPhaseChanged(EnrollmentPhase.DeviceSetup);
+            Thread.Sleep(300);
+            Assert.Equal(0, EventCount);
+
+            // Entering AccountSetup must NOT fire an exit rule.
+            _executor.OnPhaseChanged(EnrollmentPhase.AccountSetup);
+            Thread.Sleep(300);
+            Assert.Equal(0, EventCount);
+
+            // Leaving it does.
+            _executor.OnPhaseChanged(EnrollmentPhase.AppsUser);
+            Assert.True(WaitForEventCount(1));
+        }
+
+        [Fact]
+        public void DoesNotRefireWhenThePhaseIsLeftTwice()
+        {
+            _executor.UpdateRules(new List<GatherRule> { ExitRule("GATHER-PX-002", "AccountSetup") });
+
+            _executor.OnPhaseChanged(EnrollmentPhase.AccountSetup);
+            _executor.OnPhaseChanged(EnrollmentPhase.AppsUser);
+            Assert.True(WaitForEventCount(1));
+
+            // A phase can be re-entered (ESP re-reporting); the one-shot slot stays consumed.
+            _executor.OnPhaseChanged(EnrollmentPhase.AccountSetup);
+            _executor.OnPhaseChanged(EnrollmentPhase.AppsUser);
+            Thread.Sleep(400);
+            Assert.Equal(1, EventCount);
+        }
+
+        [Fact]
+        public void EmptyTriggerPhase_FiresOnEveryExit()
+        {
+            _executor.UpdateRules(new List<GatherRule> { ExitRule("GATHER-PX-003", "") });
+
+            _executor.OnPhaseChanged(EnrollmentPhase.DeviceSetup); // exit of Unknown — must NOT fire
+            Thread.Sleep(300);
+            Assert.Equal(0, EventCount);
+
+            _executor.OnPhaseChanged(EnrollmentPhase.AccountSetup); // exit of DeviceSetup
+            Assert.True(WaitForEventCount(1));
+
+            _executor.OnPhaseChanged(EnrollmentPhase.AppsUser);     // exit of AccountSetup
+            Assert.True(WaitForEventCount(2));
+        }
+
+        [Fact]
+        public void NeverFiresOnExitOfUnknown()
+        {
+            // Before the first phase signal there is no phase to leave.
+            _executor.UpdateRules(new List<GatherRule> { ExitRule("GATHER-PX-004", "") });
+
+            _executor.OnPhaseChanged(EnrollmentPhase.Start);
+            Thread.Sleep(300);
+            Assert.Equal(0, EventCount);
+        }
+
+        [Fact]
+        public void RepeatedSamePhaseSignal_IsNotAnExit()
+        {
+            _executor.UpdateRules(new List<GatherRule> { ExitRule("GATHER-PX-005", "") });
+
+            _executor.OnPhaseChanged(EnrollmentPhase.AccountSetup);
+            _executor.OnPhaseChanged(EnrollmentPhase.AccountSetup); // same phase — no transition
+            Thread.Sleep(300);
+            Assert.Equal(0, EventCount);
+        }
+
+        [Fact]
+        public void FiresOnTransitionIntoFailed_CapturingStateAtTheFailurePoint()
+        {
+            _executor.UpdateRules(new List<GatherRule> { ExitRule("GATHER-PX-006", "AccountSetup") });
+
+            _executor.OnPhaseChanged(EnrollmentPhase.AccountSetup);
+            _executor.OnPhaseChanged(EnrollmentPhase.Failed);
+
+            Assert.True(WaitForEventCount(1), "leaving a phase into Failed must still snapshot it");
+        }
+
+        [Fact]
+        public void FiresOnExitOfCompleteOnly_WhenCompleteIsActuallyLeft()
+        {
+            // "End of enrollment" is better served by phase_change on Complete / on_event; an exit
+            // rule on Complete only fires if a later transition happens at all.
+            _executor.UpdateRules(new List<GatherRule> { ExitRule("GATHER-PX-007", "Complete") });
+
+            _executor.OnPhaseChanged(EnrollmentPhase.FinalizingSetup);
+            _executor.OnPhaseChanged(EnrollmentPhase.Complete);
+            Thread.Sleep(300);
+            Assert.Equal(0, EventCount);
+        }
+
+        [Fact]
+        public void ScopeGate_EvaluatesAgainstThePhaseBeingLeft()
+        {
+            // Scope = only during DeviceSetup. Leaving DeviceSetup must fire (the rule is still in
+            // scope at that instant) even though the NEW phase is outside the scope.
+            _executor.UpdateRules(new List<GatherRule>
+            {
+                ExitRule("GATHER-PX-010", "DeviceSetup", activePhases: new List<string> { "DeviceSetup" })
+            });
+
+            _executor.OnPhaseChanged(EnrollmentPhase.DeviceSetup);
+            _executor.OnPhaseChanged(EnrollmentPhase.AccountSetup);
+
+            Assert.True(WaitForEventCount(1),
+                "the scope gate must see the phase being left, not the one being entered");
+        }
+
+        [Fact]
+        public void OutOfScopeExit_DoesNotFire_AndDoesNotConsumeTheOneShotSlot()
+        {
+            // Scope = only during AccountSetup; the rule exits DeviceSetup while out of scope.
+            var rule = ExitRule("GATHER-PX-011", "", activePhases: new List<string> { "AccountSetup" });
+            _executor.UpdateRules(new List<GatherRule> { rule });
+
+            _executor.OnPhaseChanged(EnrollmentPhase.DeviceSetup);
+            _executor.OnPhaseChanged(EnrollmentPhase.AccountSetup); // exit of DeviceSetup: out of scope
+            Thread.Sleep(300);
+            Assert.Equal(0, EventCount);
+
+            _executor.OnPhaseChanged(EnrollmentPhase.AppsUser);     // exit of AccountSetup: in scope
+            Assert.True(WaitForEventCount(1));
+        }
+
+        [Fact]
+        public void ExitAndChangeRulesForTheSamePhase_BothFireIndependently()
+        {
+            // The dedup key spaces must not collide: same ruleId shape, same phase, different trigger.
+            var enter = new GatherRule
+            {
+                RuleId = "GATHER-PX-020",
+                Title = "enter",
+                CollectorType = "registry",
+                Target = AbsentPath,
+                Trigger = "phase_change",
+                TriggerPhase = "AccountSetup",
+                OutputEventType = "gather_test",
+                Enabled = true,
+            };
+            var exit = ExitRule("GATHER-PX-021", "AccountSetup");
+            _executor.UpdateRules(new List<GatherRule> { enter, exit });
+
+            _executor.OnPhaseChanged(EnrollmentPhase.AccountSetup);
+            Assert.True(WaitForEventCount(1)); // enter fired
+
+            _executor.OnPhaseChanged(EnrollmentPhase.AppsUser);
+            Assert.True(WaitForEventCount(2)); // exit fired
+        }
+
+        [Fact]
+        public void ExitRuleWithEmitOnChange_StillEmitsItsFirstResult()
+        {
+            var rule = ExitRule("GATHER-PX-030", "AccountSetup");
+            rule.EmitMode = "on_change";
+            _executor.UpdateRules(new List<GatherRule> { rule });
+
+            _executor.OnPhaseChanged(EnrollmentPhase.AccountSetup);
+            _executor.OnPhaseChanged(EnrollmentPhase.AppsUser);
+
+            Assert.True(WaitForEventCount(1));
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Telemetry/Events/TelemetryEventEmitterTests.cs

@@ -17,13 +17,25 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Telemetry.Events
             FakeTelemetryTransport transport,
             out EventSequenceCounter counter,
             string sessionId = "sess-1",
-            string tenantId = "tenant-1")
+            string tenantId = "tenant-1",
+            Func<bool>? traceEventsEnabled = null)
         {
             var tmp = new TempDirectory();
             counter = new EventSequenceCounter(new EventSequencePersistence(tmp.File("seq.json")));
-            return new TelemetryEventEmitter(transport, counter, sessionId, tenantId);
+            return new TelemetryEventEmitter(transport, counter, sessionId, tenantId, traceEventsEnabled);
         }
 
+        private static EnrollmentEvent NewTraceEvent(string eventType = "outbound_ip") =>
+            new EnrollmentEvent
+            {
+                EventType = eventType,
+                Severity = EventSeverity.Trace,
+                Source = "test",
+                Timestamp = At,
+                Phase = EnrollmentPhase.Unknown,
+                Message = "trace message",
+            };
+
         private static EnrollmentEvent NewTestEvent(string eventType = "enrollment_complete") =>
             new EnrollmentEvent
             {
@@ -49,6 +61,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Telemetry.Events
             Assert.Equal("sess-1", evt.SessionId);
             Assert.Equal("tenant-1", evt.TenantId);
 
+            Assert.NotNull(item);
             Assert.Equal(TelemetryItemKind.Event, item.Kind);
             Assert.Equal("tenant-1_sess-1", item.PartitionKey);
             Assert.Equal(evt.RowKey, item.RowKey);
@@ -174,5 +187,86 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Telemetry.Events
             Assert.Equal("test-reason", (string?)data["reason"]);
             Assert.Equal("Strong", (string?)data["wgConfidence"]);
         }
+
+        // ============================================================ Trace-event gate
+
+        [Fact]
+        public void Trace_event_is_dropped_when_gate_is_off()
+        {
+            var transport = new FakeTelemetryTransport();
+            var emitter = Build(transport, out _, traceEventsEnabled: () => false);
+
+            var item = emitter.Emit(NewTraceEvent());
+
+            Assert.Null(item);
+            Assert.Equal(0, transport.EnqueueCount);
+        }
+
+        [Fact]
+        public void Trace_event_flows_when_gate_is_on()
+        {
+            var transport = new FakeTelemetryTransport();
+            var emitter = Build(transport, out _, traceEventsEnabled: () => true);
+
+            Assert.NotNull(emitter.Emit(NewTraceEvent()));
+            Assert.Equal(1, transport.EnqueueCount);
+        }
+
+        [Fact]
+        public void Trace_event_flows_when_no_gate_is_wired()
+        {
+            var transport = new FakeTelemetryTransport();
+            var emitter = Build(transport, out _);
+
+            Assert.NotNull(emitter.Emit(NewTraceEvent()));
+            Assert.Equal(1, transport.EnqueueCount);
+        }
+
+        [Fact]
+        public void Gate_off_does_not_suppress_non_trace_events()
+        {
+            var transport = new FakeTelemetryTransport();
+            var emitter = Build(transport, out _, traceEventsEnabled: () => false);
+
+            foreach (var severity in new[] { EventSeverity.Info, EventSeverity.Warning, EventSeverity.Error })
+            {
+                var evt = NewTestEvent();
+                evt.Severity = severity;
+                Assert.NotNull(emitter.Emit(evt));
+            }
+
+            Assert.Equal(3, transport.EnqueueCount);
+        }
+
+        [Fact]
+        public void Dropped_trace_event_does_not_consume_a_sequence_number()
+        {
+            var transport = new FakeTelemetryTransport();
+            var traceAllowed = true;
+            // ReSharper disable once AccessToModifiedClosure — deliberate: the gate is read
+            // per event, mirroring a mid-session remote-config merge.
+            var emitter = Build(transport, out _, traceEventsEnabled: () => traceAllowed);
+
+            emitter.Emit(NewTestEvent());          // seq 1
+            traceAllowed = false;
+            emitter.Emit(NewTraceEvent());         // dropped — must not burn seq 2
+            emitter.Emit(NewTestEvent());          // seq 2
+
+            Assert.Equal(2, transport.EnqueueCount);
+            var first = JObject.Parse(transport.Enqueued[0].PayloadJson);
+            var second = JObject.Parse(transport.Enqueued[1].PayloadJson);
+            Assert.Equal(1, (long)first["Sequence"]!);
+            Assert.Equal(2, (long)second["Sequence"]!);
+        }
+
+        [Fact]
+        public void Throwing_gate_fails_open_so_diagnostics_are_never_silently_lost()
+        {
+            var transport = new FakeTelemetryTransport();
+            var emitter = Build(transport, out _, traceEventsEnabled: () => throw new InvalidOperationException("boom"));
+
+            Assert.NotNull(emitter.Emit(NewTraceEvent()));
+            Assert.Equal(1, transport.EnqueueCount);
+        }
     }
 }

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Telemetry/Gather/GatherRuleExecutor.cs

@@ -176,12 +176,59 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
 
         /// <summary>
         /// Called when a phase change event occurs - executes rules triggered by phase changes
+        /// (<c>phase_change</c> on entering the new phase, <c>phase_exit</c> on leaving the old one).
         /// </summary>
         public void OnPhaseChanged(EnrollmentPhase newPhase)
         {
             var phaseName = newPhase.ToString();
 
-            // Update the phase + from-phase latches FIRST so deferred startup activation and
+            // phase_exit runs FIRST and against the phase being LEFT: both the TriggerPhase match
+            // and the scope gate must see the old phase, so this block has to complete before
+            // _currentPhase moves below. A transition INTO Failed still fires the exit rules of the
+            // phase that failed — that snapshot is the whole point at a failure boundary.
+            List<GatherRule> exitRules = null;
+            lock (_scopeLock)
+            {
+                var previousPhase = _currentPhase;
+                if (previousPhase != EnrollmentPhase.Unknown && previousPhase != newPhase)
+                {
+                    var previousPhaseName = previousPhase.ToString();
+                    exitRules = new List<GatherRule>();
+
+                    foreach (var rule in _activeRules)
+                    {
+                        if (rule.Trigger != "phase_exit") continue;
+                        if (!string.IsNullOrEmpty(rule.TriggerPhase)
+                            && !string.Equals(rule.TriggerPhase, previousPhaseName, StringComparison.OrdinalIgnoreCase))
+                            continue;
+
+                        // Scope gate before the dedup add — an out-of-scope pass must not consume
+                        // the once-per-(rule, phase) slot. IsRuleInScopeLocked still sees the old phase.
+                        if (!IsRuleInScopeLocked(rule)) continue;
+
+                        // "exit:" prefix keeps this key space disjoint from the phase_change keys.
+                        if (!_phaseRulesExecuted.Add($"exit:{rule.RuleId}|{previousPhaseName}"))
+                        {
+                            _logger.Debug($"Phase-exit rule {rule.RuleId} already executed for exit of {previousPhaseName}, skipping");
+                            continue;
+                        }
+
+                        _logger.Info($"Phase exit triggered rule {rule.RuleId} (left phase: {previousPhaseName}, now: {phaseName})");
+                        exitRules.Add(rule);
+                    }
+                }
+            }
+
+            if (exitRules != null)
+            {
+                foreach (var rule in exitRules)
+                {
+                    var exitRule = rule;
+                    ThreadPool.QueueUserWorkItem(_ => ExecuteRule(exitRule));
+                }
+            }
+
+            // Update the phase + from-phase latches so deferred startup activation and
             // the phase_change rules below all evaluate against the NEW phase.
             List<GatherRule> deferredStartup;
             lock (_scopeLock)

src/Agent/AutopilotMonitor.Agent.V2.Core/Orchestration/EnrollmentOrchestrator.cs

@@ -86,6 +86,11 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
         // Production always passes null → Start() creates the real DeadlineScheduler.
         private readonly IDeadlineScheduler? _schedulerOverride;
 
+        // Live accessor for TenantConfiguration.SendTraceEvents — read per event by the
+        // TelemetryEventEmitter so a mid-session remote-config merge takes effect. Null
+        // (tests / legacy callers) means trace events always flow.
+        private readonly Func<bool>? _traceEventsEnabled;
+
         // Max-lifetime watchdog (M4.6.α). Timer is armed in Start() when _agentMaxLifetime != null.
         private System.Threading.Timer? _maxLifetimeTimer;
         private int _terminatedFired;
@@ -166,7 +171,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
             TimeSpan? terminalDrainTimeout = null,
             TimeSpan? agentMaxLifetime = null,
             int uploadBatchSize = 100,
-            IDeadlineScheduler? schedulerOverride = null)
+            IDeadlineScheduler? schedulerOverride = null,
+            Func<bool>? traceEventsEnabled = null)
         {
             if (string.IsNullOrEmpty(sessionId)) throw new ArgumentException("SessionId is mandatory.", nameof(sessionId));
             if (string.IsNullOrEmpty(tenantId)) throw new ArgumentException("TenantId is mandatory.", nameof(tenantId));
@@ -206,6 +212,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
             _uploadBatchSize = uploadBatchSize;
 
             _schedulerOverride = schedulerOverride;
+            _traceEventsEnabled = traceEventsEnabled;
         }
 
         /// <summary>
@@ -402,7 +409,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
             //    strukturelle Abhängigkeit erlischt damit, Architektur-Baseline-Test gate
             //    shrinks to exactly two permitted callers.
             _eventSequenceCounter = new EventSequenceCounter(_eventSequencePersistence);
-            var eventEmitter = new TelemetryEventEmitter(_transport, _eventSequenceCounter, _sessionId, _tenantId);
+            var eventEmitter = new TelemetryEventEmitter(
+                _transport, _eventSequenceCounter, _sessionId, _tenantId, _traceEventsEnabled);
             _signalEmitter = new TelemetrySignalEmitter(_transport, _sessionId, _tenantId);
             _transitionEmitter = new TelemetryTransitionEmitter(_transport, _sessionId, _tenantId);
             _timelineEmitter = new EventTimelineEmitter(eventEmitter);

src/Agent/AutopilotMonitor.Agent.V2.Core/Telemetry/Events/TelemetryEventEmitter.cs

@@ -30,12 +30,14 @@ namespace AutopilotMonitor.Agent.V2.Core.Telemetry.Events
         private readonly string _sessionId;
         private readonly string _tenantId;
         private readonly string _partitionKey;
+        private readonly Func<bool>? _traceEventsEnabled;
 
         public TelemetryEventEmitter(
             ITelemetryTransport transport,
             EventSequenceCounter sequenceCounter,
             string sessionId,
-            string tenantId)
+            string tenantId,
+            Func<bool>? traceEventsEnabled = null)
         {
             if (string.IsNullOrEmpty(sessionId)) throw new ArgumentException("SessionId is mandatory.", nameof(sessionId));
             if (string.IsNullOrEmpty(tenantId)) throw new ArgumentException("TenantId is mandatory.", nameof(tenantId));
@@ -44,13 +46,18 @@ namespace AutopilotMonitor.Agent.V2.Core.Telemetry.Events
             _sessionId = sessionId;
             _tenantId = tenantId;
             _partitionKey = $"{tenantId}_{sessionId}";
+            _traceEventsEnabled = traceEventsEnabled;
         }
 
         /// <summary>
         /// Weist Sequence zu, serialisiert im Legacy-Wire-Format und enqueued via Transport.
         /// Thread-safe (EventSequenceCounter + ITelemetryTransport.Enqueue beide unter Lock).
+        /// <para>
+        /// Returns <c>null</c> when the event was suppressed by the trace-event gate — the
+        /// only drop path. Both permitted callers ignore the return value.
+        /// </para>
         /// </summary>
-        internal TelemetryItem Emit(EnrollmentEvent evt)
+        internal TelemetryItem? Emit(EnrollmentEvent evt)
         {
             if (evt == null) throw new ArgumentNullException(nameof(evt));
             if (string.IsNullOrEmpty(evt.EventType))
@@ -58,6 +65,16 @@ namespace AutopilotMonitor.Agent.V2.Core.Telemetry.Events
                 throw new ArgumentException("EnrollmentEvent.EventType is mandatory.", nameof(evt));
             }
 
+            // Trace-event gate (TenantConfiguration.SendTraceEvents, default on). Dropped
+            // before the sequence counter advances, so suppression leaves no gaps in the
+            // per-session sequence and the timeline stays contiguous. Evaluated per event
+            // rather than captured at construction: remote config is merged into the live
+            // AgentConfiguration mid-session, and the gate must follow it.
+            if (evt.Severity == EventSeverity.Trace && !TraceEventsEnabled())
+            {
+                return null;
+            }
+
             evt.Sequence = _sequenceCounter.Next();
             if (string.IsNullOrEmpty(evt.SessionId)) evt.SessionId = _sessionId;
             if (string.IsNullOrEmpty(evt.TenantId)) evt.TenantId = _tenantId;
@@ -77,5 +94,23 @@ namespace AutopilotMonitor.Agent.V2.Core.Telemetry.Events
 
             return _transport.Enqueue(draft);
         }
+
+        /// <summary>
+        /// Fail-open: no gate wired (legacy ctor / tests) or a throwing accessor means trace
+        /// events flow. The gate suppresses diagnostics, so a broken accessor must not be able
+        /// to silently blind the timeline.
+        /// </summary>
+        private bool TraceEventsEnabled()
+        {
+            if (_traceEventsEnabled == null) return true;
+            try
+            {
+                return _traceEventsEnabled();
+            }
+            catch
+            {
+                return true;
+            }
+        }
     }
 }

src/Agent/AutopilotMonitor.Agent.V2/Runtime/AgentRuntimeHost.cs

@@ -132,7 +132,10 @@ namespace AutopilotMonitor.Agent.V2.Runtime
                 whiteGloveSealingPatternIds: whiteGloveSealingPatternIds,
                 drainInterval: drainInterval,
                 agentMaxLifetime: agentMaxLifetime,
-                uploadBatchSize: uploadBatchSize))
+                uploadBatchSize: uploadBatchSize,
+                // Live read: remote config is merged into agentConfig mid-session, so the
+                // trace-event gate must follow it rather than snapshot at construction.
+                traceEventsEnabled: () => agentConfig.SendTraceEvents))
             {
                 using (var shutdown = new ManualResetEventSlim(false))
                 using (var shutdownComplete = new ManualResetEventSlim(false))

src/Shared/AutopilotMonitor.Shared/Models/Rules/GatherRule.cs

@@ -107,7 +107,11 @@ namespace AutopilotMonitor.Shared.Models
         // ===== WHEN TO COLLECT =====
 
         /// <summary>
-        /// Trigger type: "startup", "phase_change", "interval", "on_event"
+        /// Trigger type: "startup", "phase_change", "phase_exit", "interval", "on_event".
+        /// <para>
+        /// "phase_change" fires once when the phase in <see cref="TriggerPhase"/> is ENTERED,
+        /// "phase_exit" once when it is LEFT — the two one-shot bookends of a phase.
+        /// </para>
         /// </summary>
         public string Trigger { get; set; } = default!;
 
@@ -117,8 +121,9 @@ namespace AutopilotMonitor.Shared.Models
         public int? IntervalSeconds { get; set; }
 
         /// <summary>
-        /// Phase to trigger on (only used when Trigger = "phase_change")
-        /// e.g., "Identity", "MdmEnrollment", "AppInstallation"
+        /// Phase to trigger on (used when Trigger = "phase_change" or "phase_exit").
+        /// Canonical tokens are the <see cref="EnrollmentPhase"/> enum names, e.g.
+        /// "DeviceSetup", "AccountSetup", "Complete". Empty = every phase transition.
         /// </summary>
         public string TriggerPhase { get; set; } = default!;
 

src/Web/autopilot-monitor-web/app/about/page.tsx

@@ -26,9 +26,9 @@ const FEATURES = [
   {
     title: "Diagnostics Collection",
     description:
-      "Trigger on-demand diagnostic uploads directly from the portal. Collect ETL logs, event logs, IME logs, and system information from any enrolled device without local access.",
+      "Collect agent logs, IME logs, agent state, and device information as a ZIP bundle at the end of an enrollment — then download it from the session view without touching the device.",
     color: "green",
-    bullets: ["On-demand ZIP bundle upload", "ETL, event & IME log collection", "Configurable log path rules"],
+    bullets: ["Configurable upload: off, always, or on failure", "Agent, IME & device information bundle", "Configurable additional log paths"],
   },
   {
     title: "Detailed Event Timeline",
@@ -40,7 +40,7 @@ const FEATURES = [
   {
     title: "Audit Logging & Compliance",
     description:
-      "Complete audit trail of all administrative actions and configuration changes. Meet compliance requirements with detailed, tamper-evident records and configurable data retention.",
+      "Complete audit trail of all administrative actions and configuration changes. Meet compliance requirements with detailed, tenant-scoped records and configurable data retention.",
     color: "red",
     bullets: ["Admin action history", "Configurable retention policies", "Tenant-scoped audit log"],
   },
@@ -138,7 +138,7 @@ export default function AboutPage() {
               {
                 title: "MSPs & Enterprise Teams",
                 description:
-                  "Autopilot Monitor supports multi-tenant deployments — each customer tenant runs its own isolated instance. MSPs with login access to a customer environment can use the portal for that tenant independently.",
+                  "Autopilot Monitor is a multi-tenant service with strict per-tenant data isolation — telemetry, configuration, and diagnostics are partitioned and access-scoped to each tenant. MSPs can be granted delegated read access across several customer tenants from a single login.",
               },
             ].map((item) => (
               <div key={item.title} className="rounded-lg bg-blue-50 border border-blue-100 p-4">
@@ -165,7 +165,7 @@ export default function AboutPage() {
               { step: "2", text: "The bootstrapper installs the Autopilot Monitor Agent on each enrolling device." },
               { step: "3", text: "The agent captures live enrollment events and uploads them to the backend pipeline." },
               { step: "4", text: "The portal displays real-time session data, analyze rule results, and fleet health metrics." },
-              { step: "5", text: "On completion, the agent optionally self-destructs and uploads a diagnostics bundle." },
+              { step: "5", text: "On completion, the agent uploads a diagnostics bundle if configured, then removes itself." },
             ].map((item) => (
               <li key={item.step} className="flex items-start gap-3 text-sm text-gray-700">
                 <span className="inline-flex h-6 w-6 shrink-0 items-center justify-center rounded-full bg-blue-600 text-white text-xs font-bold">
@@ -189,7 +189,7 @@ export default function AboutPage() {
               {
                 title: "Backend",
                 items: [
-                  "Azure Functions (.NET 8 Isolated) — serverless, scalable API",
+                  "Azure Functions (.NET 10 Isolated, Flex Consumption) — serverless, scalable API",
                   "Azure Table Storage — high-throughput event ingestion",
                   "Azure Blob Storage — diagnostics and log bundle storage",
                   "Azure SignalR Service — real-time push to the portal",
@@ -198,10 +198,10 @@ export default function AboutPage() {
               {
                 title: "Portal (Web Frontend)",
                 items: [
-                  "Next.js 18 + TypeScript — fast, server-rendered React app",
+                  "Next.js 15 (React 18) + TypeScript — fast, server-rendered React app",
                   "Microsoft Entra ID (MSAL) — secure authentication",
-                  "Role-based access control (Admin / Operator)",
-                  "Multi-tenant architecture",
+                  "Role-based access control (Admin / Operator / Viewer)",
+                  "Multi-tenant architecture with delegated MSP access",
                 ],
               },
               {
@@ -209,16 +209,16 @@ export default function AboutPage() {
                 items: [
                   ".NET binary — lightweight, low-overhead monitoring",
                   "Runs via scheduled task (no Windows service — easy, residue-free removal)",
-                  "Deployed via Intune bootstrapper script (Win32 app)",
-                  "Client certificate authentication",
-                  "Optional self-destruct on enrollment completion",
+                  "Deployed via an Intune platform script (PowerShell bootstrapper)",
+                  "Mutual TLS using the existing Intune MDM device certificate",
+                  "Self-destruct on enrollment completion (on by default — removes task and files)",
                 ],
               },
               {
                 title: "Integrations",
                 items: [
                   "Microsoft Intune — agent deployment target",
-                  "Microsoft Teams — enrollment failure notifications",
+                  "Microsoft Teams, Slack & generic JSON webhooks — start, success, failure and SLA alerts",
                   "Intune Management Extension (IME) log — event source for log pattern detection",
                   "WMI & Registry — extended data gather rules",
                 ],
@@ -249,11 +249,17 @@ export default function AboutPage() {
             extended by the wider Windows Autopilot community.
           </p>
           <p className="text-gray-700 leading-relaxed mb-4">
-            Autopilot Monitor was created by{" "}
+            Autopilot Monitor was created and is maintained by{" "}
             <strong>Oliver Kieselbach</strong>, a Microsoft MVP and long-time contributor to the Windows
             Autopilot and Microsoft Intune community. The project is driven by real-world enterprise
             deployment experience and community feedback.
           </p>
+          <p className="text-gray-700 leading-relaxed mb-4">
+            The hosted service is operated by <strong>glueckkanja AG</strong> — see the{" "}
+            <a href="https://www.glueckkanja.com/en/imprint" target="_blank" rel="noopener noreferrer" className="text-blue-600 hover:text-blue-800 underline">Imprint</a> for company
+            details and the <Link href="/terms" className="text-blue-600 hover:text-blue-800 underline">Terms of Use</Link>{" "}
+            for what each plan does and does not commit to.
+          </p>
           <div className="flex flex-wrap gap-3 mt-5">
             <a
               href="https://github.com/okieselbach/Autopilot-Monitor"

src/Web/autopilot-monitor-web/app/gather-rules/components/GatherRuleCard.tsx

@@ -293,7 +293,16 @@ export function GatherRuleCard({
                 )}
                 {rule.trigger === "phase_change" && rule.triggerPhase && (
                   <span className="text-gray-500">
-                    on phase: <code className="px-1 bg-gray-200 rounded text-xs">{rule.triggerPhase}</code>
+                    entering <code className="px-1 bg-gray-200 rounded text-xs">{formatGatherPhase(rule.triggerPhase)}</code>
+                  </span>
+                )}
+                {rule.trigger === "phase_exit" && (
+                  <span className="text-gray-500">
+                    {rule.triggerPhase ? (
+                      <>leaving <code className="px-1 bg-gray-200 rounded text-xs">{formatGatherPhase(rule.triggerPhase)}</code></>
+                    ) : (
+                      "on every phase exit"
+                    )}
                   </span>
                 )}
                 {rule.trigger === "on_event" && rule.triggerEventType && (

src/Web/autopilot-monitor-web/app/gather-rules/components/GatherRuleFormFields.tsx

@@ -11,6 +11,7 @@ import {
   TARGET_PLACEHOLDERS,
   TARGET_HINTS,
   GATHER_PHASES,
+  PHASE_TRIGGERS,
   EMIT_MODES,
   formatTrigger,
 } from "../types";
@@ -425,7 +426,7 @@ export function GatherRuleFormFields({ form, setForm, showRuleId, unrestrictedMo
         </div>
       )}
 
-      {form.trigger === "phase_change" && (
+      {PHASE_TRIGGERS.includes(form.trigger) && (
         <div>
           <label className="block text-sm font-medium text-gray-700 mb-1">Trigger Phase</label>
           <select
@@ -433,7 +434,7 @@ export function GatherRuleFormFields({ form, setForm, showRuleId, unrestrictedMo
             onChange={(e) => setForm({ ...form, triggerPhase: e.target.value })}
             className="w-full px-4 py-2 border border-gray-300 rounded-lg text-sm text-gray-900 bg-white focus:outline-none focus:ring-2 focus:ring-indigo-500 focus:border-indigo-500 transition-colors"
           >
-            <option value="">Any phase change</option>
+            <option value="">Any phase</option>
             {form.triggerPhase && !GATHER_PHASES.some((p) => p.value === form.triggerPhase) && (
               <option value={form.triggerPhase}>{form.triggerPhase} (legacy value)</option>
             )}
@@ -441,7 +442,11 @@ export function GatherRuleFormFields({ form, setForm, showRuleId, unrestrictedMo
               <option key={p.value} value={p.value}>{p.label}</option>
             ))}
           </select>
-          <p className="text-xs text-gray-400 mt-1">Run this rule when the enrollment reaches this phase. &quot;Any phase change&quot; fires once per phase transition.</p>
+          <p className="text-xs text-gray-400 mt-1">
+            {form.trigger === "phase_exit"
+              ? "Collect once when the enrollment LEAVES this phase — a snapshot of its end state. \"Any phase\" fires on every phase transition. Also fires when the phase is left because enrollment failed."
+              : "Collect once when the enrollment REACHES this phase. \"Any phase\" fires on every phase transition."}
+          </p>
         </div>
       )}
 

src/Web/autopilot-monitor-web/app/gather-rules/page.tsx

@@ -16,7 +16,7 @@ import { FormJsonToggle, JsonModeToggleButtons } from "@/components/rules/FormJs
 import { useAuthenticatedFetch, useNotificationMessages, useGlobalAdminScope } from "@/hooks";
 import { GlobalAdminBanner, globalAdminSubtitle } from "@/components/GlobalAdminBanner";
 import { TenantScopeSelector } from "@/components/TenantScopeSelector";
-import { GatherRule, NewRuleForm, EMPTY_FORM, CATEGORY_COLORS, withDerivedScopeMode } from "./types";
+import { GatherRule, NewRuleForm, EMPTY_FORM, CATEGORY_COLORS, PHASE_TRIGGERS, withDerivedScopeMode } from "./types";
 import { GatherRuleFormFields } from "./components/GatherRuleFormFields";
 import { GatherRuleCard } from "./components/GatherRuleCard";
 
@@ -209,7 +209,7 @@ export default function GatherRulesPage() {
       parameters: buildParameters(form),
       trigger: form.trigger,
       intervalSeconds: form.trigger === "interval" ? form.intervalSeconds : null,
-      triggerPhase: form.trigger === "phase_change" ? form.triggerPhase : null,
+      triggerPhase: PHASE_TRIGGERS.includes(form.trigger) ? form.triggerPhase : null,
       triggerEventType: form.trigger === "on_event" ? form.triggerEventType : null,
       activePhases: form.scopeMode === "during" && form.activePhases.length > 0 ? form.activePhases : null,
       activeFromPhase: form.scopeMode === "from" && form.activeFromPhase ? form.activeFromPhase : null,
@@ -296,7 +296,7 @@ export default function GatherRulesPage() {
       parameters: buildParameters(form),
       trigger: form.trigger,
       intervalSeconds: form.trigger === "interval" ? form.intervalSeconds : null,
-      triggerPhase: form.trigger === "phase_change" ? form.triggerPhase : null,
+      triggerPhase: PHASE_TRIGGERS.includes(form.trigger) ? form.triggerPhase : null,
       triggerEventType: form.trigger === "on_event" ? form.triggerEventType : null,
       activePhases: form.scopeMode === "during" && form.activePhases.length > 0 ? form.activePhases : null,
       activeFromPhase: form.scopeMode === "from" && form.activeFromPhase ? form.activeFromPhase : null,

src/Web/autopilot-monitor-web/app/gather-rules/types.ts

@@ -61,7 +61,10 @@ export interface NewRuleForm {
 
 export const CATEGORIES = ["network", "identity", "apps", "device", "esp", "enrollment"] as const;
 export const COLLECTOR_TYPES = ["registry", "eventlog", "wmi", "file", "command_allowlisted", "logparser", "json", "xml"] as const;
-export const TRIGGERS = ["startup", "phase_change", "interval", "on_event"] as const;
+export const TRIGGERS = ["startup", "phase_change", "phase_exit", "interval", "on_event"] as const;
+
+/** Triggers that collect at a phase boundary and therefore use the triggerPhase field. */
+export const PHASE_TRIGGERS: ReadonlyArray<string> = ["phase_change", "phase_exit"];
 export const SEVERITIES = ["info", "warning", "error", "critical"] as const;
 
 // Canonical phase-scope tokens: the backend EnrollmentPhase enum NAMES from Start(0) through
@@ -168,7 +171,8 @@ export const EMPTY_FORM: NewRuleForm = {
 
 export function formatTrigger(trigger: string) {
   switch (trigger) {
-    case "phase_change": return "Phase Change";
+    case "phase_change": return "Phase Start";
+    case "phase_exit": return "Phase End";
     case "on_event": return "On Event";
     default: return trigger.charAt(0).toUpperCase() + trigger.slice(1);
   }

src/Web/autopilot-monitor-web/app/page.tsx

@@ -838,6 +838,7 @@ export default function LandingPage() {
                 <ul className="space-y-1.5">
                   <li><a href="/privacy" className="text-xs text-gray-500 hover:text-blue-600 transition-colors">Privacy Policy</a></li>
                   <li><a href="/terms" className="text-xs text-gray-500 hover:text-blue-600 transition-colors">Terms of Use</a></li>
+                  <li><a href="https://www.glueckkanja.com/en/imprint" target="_blank" rel="noopener noreferrer" className="text-xs text-gray-500 hover:text-blue-600 transition-colors">Imprint</a></li>
                 </ul>
               </div>
             </div>
@@ -847,7 +848,7 @@ export default function LandingPage() {
           <div className="mt-8 pt-5 border-t border-gray-200 flex flex-col sm:flex-row items-center justify-between gap-2">
             <p className="text-[11px] text-gray-400">
               &copy; 2026 Autopilot Monitor. Built with ❤️ by Oliver Kieselbach.{" "}
-              <span className="inline-block">Powered by Azure.</span>
+              <span className="inline-block">Hosted on Azure by glueckkanja AG.</span>
             </p>
             <p className="text-[11px] text-gray-400">
               Open source. Star us on{' '}

src/Web/autopilot-monitor-web/app/privacy/page.tsx

@@ -1,96 +1,212 @@
 import { PublicPageHeader } from "../../components/PublicPageHeader";
 
+const LAST_UPDATED = "21 July 2026";
+const DOCS_SECURITY_FAQ = "https://docs.autopilotmonitor.com/trust/security-faq";
+const DOCS_SUBPROCESSORS = "https://docs.autopilotmonitor.com/trust/subprocessors";
+
+function DocsLink({ href, children }: { href: string; children: React.ReactNode }) {
+  return (
+    <a
+      href={href}
+      target="_blank"
+      rel="noopener noreferrer"
+      className="text-indigo-600 hover:text-indigo-800 underline"
+    >
+      {children}
+    </a>
+  );
+}
+
 export default function PrivacyPage() {
   return (
     <div className="min-h-screen bg-gray-50">
       <PublicPageHeader title="Privacy Policy" />
       <main className="max-w-7xl mx-auto px-4 sm:px-6 lg:px-8 py-8 space-y-6">
         <div className="bg-white rounded-lg shadow p-6 space-y-4">
-          <h2 className="text-xl font-semibold text-gray-900">Data Collection</h2>
+          <p className="text-sm text-gray-500">Last updated: {LAST_UPDATED}</p>
           <p className="text-gray-700">
-            This service collects and processes the following data to provide monitoring functionality:
-          </p>
-          <ul className="list-disc list-inside space-y-2 text-gray-700 ml-4">
-            <li>Device hardware information (manufacturer, model, serial number)</li>
-            <li>Autopilot provisioning session data (status, events, timestamps)</li>
-            <li>Azure AD/Entra ID tenant information</li>
-            <li>User authentication information (UPN, display name, tenant ID)</li>
-            <li>Operational telemetry and audit logs</li>
-            <li>Anonymized usage telemetry (via Azure Application Insights, no cookies) — used to understand which features are used and improve the service. No personal data is transmitted.</li>
-          </ul>
-
-          <h2 className="text-xl font-semibold text-gray-900 mt-6">Data Processing Context</h2>
-          <p className="text-gray-700">
-            During an Autopilot enrollment, the user authenticates solely to verify their identity and initiate the process.
-            After that, the user is not actively interacting with the device while provisioning runs. As a result, the data
-            collected by the monitoring agent consists exclusively of <strong>technical enrollment events</strong> — no user
-            activity, browsing data, or personal content is captured.
-          </p>
-          <p className="text-gray-700">
-            Tenant administrators retain full control over collected data through the following options:
-          </p>
-          <ul className="list-disc list-inside space-y-2 text-gray-700 ml-4">
-            <li><strong>Data Retention</strong> — configurable retention period per tenant (default 90 days); expired sessions are automatically purged</li>
-            <li><strong>Delete Session</strong> — delete individual monitoring sessions on demand</li>
-            <li><strong>Offboard Tenant</strong> — remove all data and configurations for a tenant from the service</li>
-          </ul>
-          <p className="text-gray-700">
-            These controls ensure that no personal information accumulates in the backend beyond what is necessary for
-            enrollment monitoring. The service is designed for operational transparency, not user surveillance.
+            Autopilot Monitor collects technical telemetry about Windows Autopilot enrollments so that IT teams can see
+            what happened during a device provisioning and why it failed. This policy explains what is collected, where it
+            is stored, who can reach it, and how long it is kept. The technical detail behind every statement here is
+            published in the <DocsLink href={DOCS_SECURITY_FAQ}>Security &amp; Privacy FAQ</DocsLink>.
           </p>
 
-          <h2 className="text-xl font-semibold text-gray-900 mt-6">Data Storage & Security</h2>
+          <h2 className="text-xl font-semibold text-gray-900 mt-6">Roles: Who Is Responsible for What</h2>
           <p className="text-gray-700">
-            The platform is built with a layered security architecture designed to protect data at every level:
+            For enrollment telemetry, <strong>your organization is the controller and Autopilot Monitor acts as your
+            processor</strong>. You decide which devices are monitored, what additional data your gather rules collect,
+            how long it is retained, and when it is deleted.
+          </p>
+          <p className="text-gray-700">
+            For operating the service itself — administrator accounts, the audit trail of portal actions, and operational
+            telemetry — <strong>glueckkanja AG</strong> is the controller.
+          </p>
+          <p className="text-gray-700">
+            glueckkanja AG, a German company certified to ISO/IEC 27001, operates Autopilot Monitor for{" "}
+            <strong>both plans</strong> — the same service, the same infrastructure, the same protection measures. Company
+            details are in the <a href="https://www.glueckkanja.com/en/imprint" target="_blank" rel="noopener noreferrer" className="text-indigo-600 hover:text-indigo-800 underline">Imprint</a>.
+            The project is maintained by Oliver Kieselbach, who acts in that role on behalf of glueckkanja AG and is the
+            contact for the open-source project and the Community edition.
+          </p>
+          <p className="text-gray-700">
+            A <strong>data processing agreement (DPA / AVV) is available on request</strong>, concluded with
+            glueckkanja AG. On the Enterprise plan it forms part of the written agreement.
           </p>
 
-          <h3 className="text-lg font-medium text-gray-800 mt-4">Authentication & Device Identity</h3>
+          <h2 className="text-xl font-semibold text-gray-900 mt-6">What We Collect</h2>
+          <h3 className="text-lg font-medium text-gray-800 mt-4">From enrolling devices</h3>
           <ul className="list-disc list-inside space-y-2 text-gray-700 ml-4">
-            <li>Device agents authenticate via <strong>Intune MDM client certificates</strong>, validated against the embedded Intune CA chain</li>
-            <li>Web users authenticate via <strong>Microsoft Entra ID (Azure AD)</strong> with multi-tenant JWT validation</li>
-            <li><strong>Autopilot device validation</strong> via Microsoft Graph — only registered Autopilot devices are accepted</li>
-            <li>Optional <strong>hardware whitelist</strong> for additional device verification</li>
-            <li>Per-device <strong>rate limiting</strong> (sliding window) to prevent abuse</li>
+            <li><strong>Device identity</strong> — serial number, device name, manufacturer, model, and the Entra ID tenant the device enrolls into</li>
+            <li><strong>Enrollment progress</strong> — phases, ESP stages, application and script results, policy activity, reboots, timings, and failure codes</li>
+            <li><strong>Device context</strong> — OS build, hardware characteristics, disk and network state, plus whatever your own gather rules request</li>
+            <li><strong>Approximate location</strong> — country, region, city, and approximate coordinates, if geolocation is enabled for your tenant</li>
           </ul>
 
-          <h3 className="text-lg font-medium text-gray-800 mt-4">Tenant Isolation</h3>
+          <h3 className="text-lg font-medium text-gray-800 mt-4">From portal users</h3>
           <ul className="list-disc list-inside space-y-2 text-gray-700 ml-4">
-            <li>Strict <strong>multi-tenant data isolation</strong> — all storage queries are partitioned by Tenant ID</li>
-            <li>Real-time channels (SignalR) are scoped to <strong>tenant-specific groups</strong></li>
-            <li>Independent configuration, audit logs, and device management per tenant</li>
+            <li>Sign-in identity from Microsoft Entra ID — user principal name, display name, and tenant ID</li>
+            <li>Audit records of administrative actions, including who performed them and when</li>
+            <li>Operational request telemetry used to run and support the service</li>
           </ul>
 
-          <h3 className="text-lg font-medium text-gray-800 mt-4">Transport & Data Protection</h3>
-          <ul className="list-disc list-inside space-y-2 text-gray-700 ml-4">
-            <li>All communication encrypted via <strong>HTTPS/TLS</strong>; real-time updates via secure WebSocket</li>
-            <li>Diagnostics upload URLs are issued on-demand, and never persisted on the device</li>
-            <li>Azure Storage encryption at rest for all persisted data</li>
-            <li>PII logging disabled in production environments</li>
-          </ul>
-
-          <h3 className="text-lg font-medium text-gray-800 mt-4">Access Control</h3>
-          <ul className="list-disc list-inside space-y-2 text-gray-700 ml-4">
-            <li><strong>Role-based access</strong>: Tenant Admin (full tenant management), Operator, Users</li>
-            <li>Device blocking capabilities for compromised or unauthorized devices</li>
-            <li>Comprehensive <strong>audit logging</strong> of administrative actions</li>
-          </ul>
-
-          <h2 className="text-xl font-semibold text-gray-900 mt-6">Data Sharing</h2>
+          <h2 className="text-xl font-semibold text-gray-900 mt-6">What We Do Not Collect</h2>
           <p className="text-gray-700">
-            Your data is not shared with third parties. Access is restricted to:
+            During Autopilot provisioning the user signs in once to start the process and then does not interact with the
+            device while it provisions. The agent captures <strong>no browsing history, no file or document content, no
+            keystrokes, no screen content, and no application usage tracking</strong>. It removes itself when enrollment
+            finishes. The service is designed for operational transparency, not user surveillance.
+          </p>
+          <p className="text-gray-700">
+            Gather rules cannot be used to widen this: <code className="text-sm bg-gray-100 px-1 py-0.5 rounded">C:\Users</code>{" "}
+            is always blocked for privacy reasons, and downloading files, creating users, manipulating boot configuration,
+            and establishing persistence are hard-blocked and cannot be enabled by configuration.
+          </p>
+
+          <h2 className="text-xl font-semibold text-gray-900 mt-6">IP Addresses and Geolocation</h2>
+          <p className="text-gray-700">
+            Geolocation is a tenant setting and is <strong>enabled by default</strong>. While it is enabled:
           </p>
           <ul className="list-disc list-inside space-y-2 text-gray-700 ml-4">
-            <li>Authenticated users within your tenant</li>
-            <li>Global Administrators (for platform operations and support)</li>
+            <li>The <strong>session record</strong> stores only the derived location — country, region, city, and approximate coordinates. The IP is deliberately excluded from the location event shown in the timeline.</li>
+            <li>The <strong>outbound public IP is additionally stored once per session as a separate diagnostic event.</strong> It is hidden from the timeline view by default, but it is retained and queryable, and it expires with your retention period like any other event.</li>
+            <li>Service request telemetry does not carry device IP addresses; the platform masks them and the application never sets them.</li>
+            <li>A source IP is also stored on <strong>distress reports</strong> — the emergency channel an agent uses to report that it is failing — as part of that incident record.</li>
+          </ul>
+          <p className="text-gray-700">
+            <strong>Disabling geolocation stops all of this</strong> — no IP and no location data is collected. It is a
+            tenant setting and also an agent command-line switch. Only the Geographic Performance view is affected.
+          </p>
+
+          <h2 className="text-xl font-semibold text-gray-900 mt-6">Where Your Data Is Stored</h2>
+          <p className="text-gray-700">
+            All customer data — sessions, events, configuration, audit logs, diagnostics, and backups — is stored in
+            Microsoft Azure in <strong>Germany West Central</strong>. The only component outside that region is the portal
+            front-end, served as static assets from West Europe; it stores no customer data. There is no cross-region
+            replication and no transfer of customer data outside the EU by the platform.
+          </p>
+
+          <h2 className="text-xl font-semibold text-gray-900 mt-6">Who Can Access Your Data</h2>
+          <p className="text-gray-700">
+            Your data is not sold, and it is not shared with third parties for their own purposes. Access is limited to:
+          </p>
+          <ul className="list-disc list-inside space-y-2 text-gray-700 ml-4">
+            <li><strong>Authenticated users in your own tenant</strong>, according to their role — Admin, Operator, Viewer, or a role-less Member limited to the Progress Portal</li>
+            <li><strong>Platform operators</strong> — Global Admin for operations and support, and Global Reader for read-only support with configuration secrets redacted</li>
+            <li><strong>Delegated (MSP) administrators you or your provider have been granted</strong> — read-only, limited to exactly the tenants in scope, with configuration secrets redacted, and with every grant and revocation written to <em>your</em> tenant&apos;s audit log so you can always see who was given access to your data</li>
+          </ul>
+          <p className="text-gray-700">
+            Delegated administration is an Enterprise capability and is off unless explicitly granted. Full detail on the
+            isolation model is in the <DocsLink href={DOCS_SECURITY_FAQ}>Security &amp; Privacy FAQ</DocsLink>.
+          </p>
+
+          <h2 className="text-xl font-semibold text-gray-900 mt-6">Sub-processors and Outbound Data Flows</h2>
+          <p className="text-gray-700">
+            <strong>Microsoft Azure is the only sub-processor that stores your data.</strong> Resend is used solely to
+            deliver the onboarding approval email when a tenant is activated — it receives an administrator&apos;s email
+            address and the tenant domain, never enrollment telemetry. Vulnerability reference data is pulled inbound from
+            NVD, the CISA KEV catalog, and MSRC; no customer data is sent to them.
+          </p>
+          <p className="text-gray-700">
+            Some data flows exist only because you configure them: your own Azure storage account for diagnostics,
+            notification channels such as Teams, Slack, or a generic webhook, and your own AI assistant if a user connects
+            one through the MCP integration. The platform itself makes no calls to any AI or LLM provider. The complete
+            list is published as <DocsLink href={DOCS_SUBPROCESSORS}>Sub-processors</DocsLink>, and new sub-processors are
+            announced there before they are introduced.
+          </p>
+
+          <h2 className="text-xl font-semibold text-gray-900 mt-6">Diagnostics Uploads</h2>
+          <p className="text-gray-700">
+            Diagnostics upload is <strong>off by default</strong>. When enabled, the default destination is{" "}
+            <strong>your own Azure storage account</strong> — the package never reaches our infrastructure. Hosted upload
+            exists as an alternative but is opt-in only and requires an explicit administrator action behind a clearly
+            marked disclosure that data leaves your tenant. It is never enabled silently.
+          </p>
+
+          <h2 className="text-xl font-semibold text-gray-900 mt-6">How Long We Keep Data</h2>
+          <p className="text-gray-700">
+            Retention is <strong>configured by you per tenant, defaulting to 90 days</strong> — 7 to 90 days on the
+            Community plan and 7 to 365 days on Enterprise. Expired sessions are purged automatically. You additionally
+            control:
+          </p>
+          <ul className="list-disc list-inside space-y-2 text-gray-700 ml-4">
+            <li><strong>Delete session</strong> — remove an individual monitoring session on demand</li>
+            <li><strong>Offboard tenant</strong> — remove your tenant&apos;s data and configuration from the service entirely, as a verified multi-phase cascade</li>
+          </ul>
+          <p className="text-gray-700">
+            Two things intentionally survive tenant offboarding, neither of which contains enrollment telemetry or
+            personal data:
+          </p>
+          <ul className="list-disc list-inside space-y-2 text-gray-700 ml-4">
+            <li><strong>Product feedback</strong> you submitted — it is not tied to enrollment data and is what improves the product.</li>
+            <li><strong>Custom rules and IME log patterns</strong> you authored are archived rather than deleted. Detection knowledge is what makes this product useful, so contributed rules and patterns are subject to entering the community pool — the next organization hitting the same enrollment failure gets a diagnosis instead of a mystery. A rule is a detection definition, not device data.</li>
+          </ul>
+          <p className="text-gray-700">
+            Either can be removed on request.
+          </p>
+
+          <h2 className="text-xl font-semibold text-gray-900 mt-6">How Your Data Is Protected</h2>
+          <ul className="list-disc list-inside space-y-2 text-gray-700 ml-4">
+            <li><strong>Device authentication by mutual TLS</strong> using the Intune MDM client certificate, validated against pinned Intune root CAs rather than the operating system trust store — and rejected if no trust anchor loads</li>
+            <li><strong>Autopilot device validation via Microsoft Graph</strong> — only devices registered in your tenant are accepted, with an optional hardware allow-list on top</li>
+            <li><strong>Entra ID authentication</strong> for portal users with a restricted signing-algorithm allow-list and identity PII logging disabled</li>
+            <li><strong>Fail-closed authorization</strong> — every API route must be registered with an access policy; an unregistered route is unreachable</li>
+            <li><strong>Structural tenant isolation</strong> — storage partitioning by tenant, with the tenant identity taken from the validated token and never from a client-supplied header</li>
+            <li><strong>Encryption</strong> — HTTPS with a TLS 1.2 floor in transit, Azure Storage encryption at rest with platform-managed keys</li>
+            <li><strong>Managed identity instead of storage keys</strong>, and secret-less OIDC deployment pipelines</li>
+            <li><strong>Rate limiting</strong> per device, per portal user, and per MCP user</li>
+            <li><strong>Verifiable agent binaries</strong> — Sigstore build attestation plus a four-stage integrity chain through download, backend cross-check, and runtime self-verification</li>
+            <li><strong>Manifest-first deletion</strong> — what will be deleted is captured, restorably, before anything is removed</li>
           </ul>
 
           <h2 className="text-xl font-semibold text-gray-900 mt-6">Your Rights</h2>
           <p className="text-gray-700">
-            As this is an environment operated under best-effort principles, formal data subject rights (access, deletion, portability)
-            are not guaranteed. However, we will make reasonable efforts to accommodate such requests on a case-by-case basis.
+            Where the GDPR applies, you have the right to access, correction, deletion, restriction of processing,
+            portability, and to object to processing. We act on such requests within the statutory time limits. In
+            practice most requests resolve immediately in the portal, because deletion of individual sessions, full tenant
+            offboarding, and the retention period are all controls you hold yourself.
+          </p>
+          <p className="text-gray-700">
+            Where Autopilot Monitor acts as your processor, requests from your own employees should be directed to your
+            organization; we support you in fulfilling them.
+          </p>
+
+          <h2 className="text-xl font-semibold text-gray-900 mt-6">Changes to This Policy</h2>
+          <p className="text-gray-700">
+            Material changes are reflected in the &quot;last updated&quot; date above and announced through the service
+            announcements in the portal. If you hold a signed data processing agreement, notification follows the terms of
+            that agreement.
+          </p>
+
+          <h2 className="text-xl font-semibold text-gray-900 mt-6">Contact</h2>
+          <p className="text-gray-700">
+            For privacy questions, a data processing agreement, or a data subject request, contact glueckkanja AG using
+            the details in the <a href="https://www.glueckkanja.com/en/imprint" target="_blank" rel="noopener noreferrer" className="text-indigo-600 hover:text-indigo-800 underline">Imprint</a>.
+            For the open-source project and the Community edition you can also reach the maintainer via{" "}
+            <a href="https://www.linkedin.com/in/oliver-kieselbach" target="_blank" rel="noopener noreferrer" className="text-indigo-600 hover:text-indigo-800 underline">LinkedIn</a>{" "}
+            or open a{" "}
+            <a href="https://github.com/okieselbach/Autopilot-Monitor/issues" target="_blank" rel="noopener noreferrer" className="text-indigo-600 hover:text-indigo-800 underline">GitHub issue</a>.
           </p>
         </div>
-
       </main>
     </div>
   );

src/Web/autopilot-monitor-web/app/terms/page.tsx

@@ -1,47 +1,145 @@
 import { PublicPageHeader } from "../../components/PublicPageHeader";
 
+const LAST_UPDATED = "21 July 2026";
+const DOCS_SECURITY_FAQ = "https://docs.autopilotmonitor.com/trust/security-faq";
+const DOCS_PLANS = "https://docs.autopilotmonitor.com/plans";
+
 export default function TermsPage() {
   return (
     <div className="min-h-screen bg-gray-50">
       <PublicPageHeader title="Terms of Use" />
       <main className="max-w-7xl mx-auto px-4 sm:px-6 lg:px-8 py-8 space-y-6">
         <div className="bg-white rounded-lg shadow p-6 space-y-4">
+          <p className="text-sm text-gray-500">Last updated: {LAST_UPDATED}</p>
           <p className="text-gray-700">
-            By using this service, you agree to the following terms:
+            Autopilot Monitor is provided by <strong>glueckkanja AG</strong>, a German company certified to ISO/IEC
+            27001 — see the <a href="https://www.glueckkanja.com/en/imprint" target="_blank" rel="noopener noreferrer" className="text-indigo-600 hover:text-indigo-800 underline">Imprint</a>.
+            Both plans run on the same service and the same infrastructure; the plan determines operating limits,
+            support, and contractual commitments, not how the service works.
+          </p>
+          <p className="text-gray-700">
+            The project was created and is maintained by <strong>Oliver Kieselbach</strong>, who is also the contact for
+            the open-source project and the Community edition. He acts in that role on behalf of glueckkanja AG; he is
+            not a separate contracting party.
+          </p>
+
+          <div className="grid gap-4 md:grid-cols-2 mt-4">
+            <div className="p-4 border border-gray-200 rounded-lg">
+              <h3 className="font-semibold text-gray-900 mb-1">Community</h3>
+              <p className="text-sm text-gray-700">
+                Free, invite-only, currently in Private Preview, and maintained by Oliver Kieselbach as an open
+                community contribution. Provided <strong>without any commitment by glueckkanja AG</strong> as to
+                availability, support, or fitness for a particular purpose. Support is community-based via GitHub.
+              </p>
+            </div>
+            <div className="p-4 border border-gray-200 rounded-lg">
+              <h3 className="font-semibold text-gray-900 mb-1">Enterprise</h3>
+              <p className="text-sm text-gray-700">
+                Commercial plan under a written agreement with glueckkanja AG. Includes support and reliability
+                commitments, a data processing agreement, higher operating limits, extended retention, and delegated
+                (MSP) administration. Where that agreement differs from these terms, the agreement prevails.
+              </p>
+            </div>
+          </div>
+          <p className="text-gray-700">
+            The sections below apply to both plans unless stated otherwise. Plan details are documented under{" "}
+            <a href={DOCS_PLANS} target="_blank" rel="noopener noreferrer" className="text-indigo-600 hover:text-indigo-800 underline">Plans</a>.
+          </p>
+
+          <div className="bg-blue-50 border-l-4 border-blue-400 p-4 rounded">
+            <p className="text-blue-900 text-sm">
+              <strong>Who can use it.</strong> Autopilot Monitor requires a Microsoft Entra ID tenant with Intune and
+              registered Autopilot devices. The <strong>Community</strong> plan is open to anyone with such a tenant —
+              organizations, non-profits, and individuals running their own lab or personal tenant alike. The{" "}
+              <strong>Enterprise</strong> plan is a commercial agreement and is offered to businesses and organizations
+              acting in a commercial or professional capacity.
+            </p>
+          </div>
+        </div>
+
+        <div className="bg-white rounded-lg shadow p-6 space-y-4">
+          <h2 className="text-xl font-semibold text-gray-900">Acceptable Use</h2>
+          <p className="text-gray-700">By using this service, you agree that:</p>
+          <ul className="list-disc list-inside space-y-2 text-gray-700 ml-4">
+            <li>The service is used to monitor and troubleshoot Windows Autopilot deployments for devices your organization is entitled to manage.</li>
+            <li>You are responsible for ensuring your use complies with your organization&apos;s policies, your works council or employee representation obligations, and applicable law — including informing your users about monitoring where required.</li>
+            <li>Access requires authentication via Microsoft Entra ID, and each tenant&apos;s data is accessible only to authorized users of that tenant, or to parties you have granted delegated access.</li>
+            <li>You will not attempt to access another tenant&apos;s data, circumvent security controls, or probe the service for vulnerabilities without prior written agreement.</li>
+            <li>You will not use gather rules or any other configuration to collect data unrelated to enrollment diagnostics, or to monitor individual employees.</li>
+            <li>You will not use the service to build a competing product, or resell access without an agreement permitting it.</li>
+            <li>Automated access, including through the MCP integration, stays within the published rate limits and quotas.</li>
+          </ul>
+          <p className="text-gray-700">
+            Responsible disclosure of a security issue is welcome and will not be treated as a violation — report it
+            privately rather than publicly.
+          </p>
+        </div>
+
+        <div className="bg-white rounded-lg shadow p-6 space-y-4">
+          <h2 className="text-xl font-semibold text-gray-900">Delegated (MSP) Administration</h2>
+          <p className="text-gray-700">
+            Delegated administration lets a managing organization see a defined set of customer tenants from one place. It
+            is an Enterprise capability and applies only where access has been granted.
           </p>
           <ul className="list-disc list-inside space-y-2 text-gray-700 ml-4">
-            <li>This service is provided for monitoring and troubleshooting Windows Autopilot deployments in your organization.</li>
-            <li>You are responsible for ensuring that your use of this service complies with your organization's policies and applicable laws.</li>
-            <li>Access to this service requires proper authentication via Azure AD/Entra ID.</li>
-            <li>Each tenant's data is isolated and accessible only to authorized users of that tenant.</li>
-            <li>You must not attempt to access data belonging to other tenants or circumvent security measures.</li>
-            <li>The service operator reserves the right to suspend or terminate access at any time without prior notice.</li>
+            <li>Delegated access is <strong>read-only</strong> and limited to exactly the tenants in scope. Configuration secrets are redacted.</li>
+            <li>A grant is either assigned by platform operators or delegated by the customer&apos;s own tenant admin; customer-initiated delegations require approval before they take effect.</li>
+            <li>Every grant, revocation, and disablement is recorded in the <strong>managed customer tenant&apos;s</strong> audit log, so a customer can always determine who holds access to their data.</li>
+            <li>A managing organization acts as a processor or sub-processor of its customers and is responsible for having the necessary agreements in place with them.</li>
+            <li>Access can be revoked at any time by the customer or by platform operators and takes effect within seconds.</li>
           </ul>
         </div>
 
         <div className="bg-white rounded-lg shadow p-6 space-y-4">
-          <h2 className="text-xl font-semibold text-gray-900">Legal Disclaimer</h2>
+          <h2 className="text-xl font-semibold text-gray-900">Availability, Support and Data</h2>
+
           <div className="bg-amber-50 border-l-4 border-amber-500 p-4 rounded">
-            <h3 className="font-semibold text-amber-900 mb-2">AS-IS, No Warranty</h3>
+            <h3 className="font-semibold text-amber-900 mb-2">Community plan: provided &quot;AS-IS&quot;, no warranty</h3>
             <p className="text-amber-800 text-sm">
-              This software is provided "AS-IS" without any warranty of any kind, either expressed or implied,
-              including but not limited to the implied warranties of merchantability and fitness for a particular purpose.
+              The Community plan is provided free of charge, &quot;AS-IS&quot;, and without warranty of any kind, express
+              or implied, including the implied warranties of merchantability and fitness for a particular purpose. It is
+              currently in Private Preview: updates are frequent, availability is not guaranteed, and data structures may
+              change. Production use is permitted and intended — with that trade-off understood.
             </p>
           </div>
+
           <div className="space-y-2 text-gray-700">
-            <p><strong>No Liability:</strong> The service operator shall not be liable for any damages, including but not limited to direct, indirect, incidental, special, consequential, or punitive damages arising out of the use or inability to use this service.</p>
-            <p><strong>No Service Level Agreement (SLA):</strong> This service is provided without any guaranteed uptime or availability. Service interruptions, maintenance windows, or complete shutdown may occur without prior notice.</p>
-            <p><strong>No Data Backup Guarantee:</strong> While we implement data retention policies, we do not guarantee the preservation of your data. You are responsible for maintaining your own backups and records.</p>
-            <p><strong>Best Effort Support:</strong> Support is provided on a best-effort basis with no guaranteed response times or resolution commitments.</p>
-            <p><strong>Use at Your Own Risk:</strong> By using this service, you acknowledge that you do so at your own risk and that you are solely responsible for any consequences arising from your use of the service.</p>
-            <p><strong>Active Development Notice:</strong> This project is under active development. Service interruptions or unexpected behavior can occur at any time, especially when updates are deployed to the backend, web application, or agent components.</p>
+            <p><strong>Availability.</strong> The Community plan carries no uptime or availability commitment; interruptions, maintenance, and changes can occur without prior notice. The Enterprise plan carries the availability commitments set out in its agreement.</p>
+            <p><strong>Support.</strong> Community support is best-effort via <a href="https://github.com/okieselbach/Autopilot-Monitor/issues" target="_blank" rel="noopener noreferrer" className="text-indigo-600 hover:text-indigo-800 underline">GitHub issues</a>, provided by the project maintainer and the community, with no guaranteed response or resolution time; built-in rules and IME log patterns are community-maintained. Enterprise support follows the response commitments in its agreement.</p>
+            <p><strong>Data durability.</strong> Autopilot Monitor is a monitoring system, not a system of record. Configuration, authorization, and rule data is backed up daily; session and event telemetry is time-bounded operational data and is <strong>not</strong> backed up. Retain anything you need for compliance or reporting purposes in your own systems.</p>
+            <p><strong>Liability.</strong> To the extent permitted by law, glueckkanja AG is not liable for indirect, incidental, special, consequential, or punitive damages, or for loss of data, profit, or business, arising from use of or inability to use the service. For the Community plan, which is provided free of charge, liability is limited to intent and gross negligence. Liability for injury to life, body or health and under mandatory statutory provisions remains unaffected. For the Enterprise plan, the liability provisions of the written agreement apply.</p>
+            <p><strong>Use at your own risk.</strong> The service reports on enrollments; it does not perform them. Operational decisions you take based on its output remain your responsibility.</p>
           </div>
         </div>
 
         <div className="bg-white rounded-lg shadow p-6 space-y-4">
-          <h2 className="text-xl font-semibold text-gray-900">Third-Party Data Sources & Attributions</h2>
+          <h2 className="text-xl font-semibold text-gray-900">Your Data, Suspension and Termination</h2>
+          <div className="space-y-2 text-gray-700">
+            <p><strong>Ownership.</strong> Your enrollment telemetry remains yours. Autopilot Monitor processes it to provide the service, as described in the <a href="/privacy" className="text-indigo-600 hover:text-indigo-800 underline">Privacy Policy</a>.</p>
+            <p><strong>Your controls.</strong> You set the retention period, delete individual sessions, and offboard your tenant entirely at any time — no support ticket required.</p>
+            <p><strong>Rules you contribute.</strong> Analyze rules, gather rules, and IME log patterns you author are detection definitions, not device data. By creating them you grant a non-exclusive, royalty-free right to retain them and to include them in the shared community rule pool, so that other organizations can benefit from a detection you built. This is the reciprocal side of a product whose built-in rules are community-maintained. You keep the right to use your own rules however you like, and you can request removal from the pool at any time.</p>
+            <p><strong>Suspension.</strong> Access may be suspended where use threatens the integrity, security, or availability of the service or of other tenants — for example abusive request volumes or attempts to reach other tenants&apos; data. Where circumstances permit, notice is given first.</p>
+            <p><strong>Termination.</strong> You may stop using the service and offboard at any time. For the Community plan, the operator may discontinue the service or an individual tenant&apos;s access; reasonable advance notice will be given except where security requires immediate action. Enterprise termination follows its agreement.</p>
+            <p><strong>After offboarding.</strong> Your tenant&apos;s data is removed through a verified multi-phase cascade. Product feedback you submitted, and custom rules and IME log patterns you authored, are intentionally retained — neither contains enrollment telemetry or personal data. Both are removed on request.</p>
+          </div>
+        </div>
+
+        <div className="bg-white rounded-lg shadow p-6 space-y-4">
+          <h2 className="text-xl font-semibold text-gray-900">Security and Transparency</h2>
           <p className="text-gray-700">
-            The vulnerability correlation feature uses the following external data sources to identify known vulnerabilities in installed software:
+            The security architecture, data residency, sub-processors, retention and deletion behaviour, and an explicit
+            statement of what the service does <em>not</em> do are published in the{" "}
+            <a href={DOCS_SECURITY_FAQ} target="_blank" rel="noopener noreferrer" className="text-indigo-600 hover:text-indigo-800 underline">Security &amp; Privacy FAQ</a>.
+            A signed data processing agreement is part of the Enterprise plan.
+          </p>
+        </div>
+
+        <div className="bg-white rounded-lg shadow p-6 space-y-4">
+          <h2 className="text-xl font-semibold text-gray-900">Third-Party Data Sources &amp; Attributions</h2>
+          <p className="text-gray-700">
+            The vulnerability correlation feature uses the following external data sources to identify known
+            vulnerabilities in installed software. These are inbound reference-data pulls — no customer data is sent to
+            them.
           </p>
           <div className="space-y-3">
             <div className="p-4 border border-gray-200 rounded-lg">
@@ -71,6 +169,15 @@ export default function TermsPage() {
           </div>
         </div>
 
+        <div className="bg-white rounded-lg shadow p-6 space-y-4">
+          <h2 className="text-xl font-semibold text-gray-900">Changes and Governing Law</h2>
+          <div className="space-y-2 text-gray-700">
+            <p><strong>Changes.</strong> These terms may be updated; the &quot;last updated&quot; date above reflects the current version, and material changes are announced through the service announcements in the portal. Continued use after a change constitutes acceptance.</p>
+            <p><strong>Governing law.</strong> These terms are governed by German law. For the Enterprise plan, the governing-law and venue provisions of the written agreement apply.</p>
+            <p><strong>Severability.</strong> If a provision is found unenforceable, the remaining provisions stay in effect.</p>
+            <p><strong>Contact.</strong> Company details are in the <a href="https://www.glueckkanja.com/en/imprint" target="_blank" rel="noopener noreferrer" className="text-indigo-600 hover:text-indigo-800 underline">Imprint</a>. For the project and the Community edition, reach the maintainer via <a href="https://www.linkedin.com/in/oliver-kieselbach" target="_blank" rel="noopener noreferrer" className="text-indigo-600 hover:text-indigo-800 underline">LinkedIn</a> or open a <a href="https://github.com/okieselbach/Autopilot-Monitor/issues" target="_blank" rel="noopener noreferrer" className="text-indigo-600 hover:text-indigo-800 underline">GitHub issue</a>.</p>
+          </div>
+        </div>
       </main>
     </div>
   );

src/Web/autopilot-monitor-web/components/Navbar.tsx

@@ -536,6 +536,19 @@ export default function Navbar() {
                     </svg>
                     <span>Terms of Use</span>
                   </Link>
+
+                  <a
+                    href="https://www.glueckkanja.com/en/imprint"
+                    target="_blank"
+                    rel="noopener noreferrer"
+                    className="w-full flex items-center gap-2.5 px-3 py-2 text-sm text-gray-700 hover:bg-gray-50 transition-colors"
+                    onClick={() => setShowHelp(false)}
+                  >
+                    <svg className="w-4 h-4 text-gray-400" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={2}>
+                      <path strokeLinecap="round" strokeLinejoin="round" d="M19 21V5a2 2 0 00-2-2H7a2 2 0 00-2 2v16m14 0h2m-2 0h-5m-9 0H3m2 0h5M9 7h1m-1 4h1m4-4h1m-1 4h1m-5 10v-5a1 1 0 011-1h2a1 1 0 011 1v5m-4 0h4" />
+                    </svg>
+                    <span>Imprint</span>
+                  </a>
                 </div>
               )}
             </div>
@@ -700,6 +713,10 @@ export default function Navbar() {
                         <svg className="w-4 h-4 text-gray-400" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={2}><path strokeLinecap="round" strokeLinejoin="round" d="M9 12h6m-6 4h6m2 5H7a2 2 0 01-2-2V5a2 2 0 012-2h5.586a1 1 0 01.707.293l5.414 5.414a1 1 0 01.293.707V19a2 2 0 01-2 2z" /></svg>
                         <span>Terms of Use</span>
                       </Link>
+                      <a href="https://www.glueckkanja.com/en/imprint" target="_blank" rel="noopener noreferrer" className="w-full flex items-center gap-2.5 px-3 py-2 text-sm text-gray-700 dark:text-gray-200 hover:bg-gray-50 dark:hover:bg-gray-700 transition-colors" onClick={() => { setShowOverflow(false); setOverflowSubmenu(null); }}>
+                        <svg className="w-4 h-4 text-gray-400" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={2}><path strokeLinecap="round" strokeLinejoin="round" d="M19 21V5a2 2 0 00-2-2H7a2 2 0 00-2 2v16m14 0h2m-2 0h-5m-9 0H3m2 0h5M9 7h1m-1 4h1m4-4h1m-1 4h1m-5 10v-5a1 1 0 011-1h2a1 1 0 011 1v5m-4 0h4" /></svg>
+                        <span>Imprint</span>
+                      </a>
                     </>
                   )}