Privacy policy

For Preflight, this policy documents implemented behavior only. It is not a GDPR, CCPA, SOC, ISO, or other regulatory certification.

What Exactlane is

Exactlane checks whether a specific MCP capability revision fits a specific agent workflow before the caller relies on it. It compares a caller-supplied MCP capability snapshot against caller-stated workflow requirements and returns bounded static compatibility evidence. Exactlane does not probe live endpoints and does not certify security, full MCP conformance, provider trust, live availability, payment success, or business-result correctness. The caller owns CONTINUE / UPDATE_INTEGRATION / HOLD.

No signup

Public Agent Preview does not require an account, signup, email address, or human approval. Human pages do not use JavaScript, browser analytics tags, advertising cookies, or third-party fonts.

Information processed

When Public Agent Preview, the REST API, or the remote MCP adapter is used, Exactlane may store:

• an optional display_label supplied with a grant
• caller-provided capability snapshots and workflow requirements
• finished check reports and owner-private report artifacts
• optional usage-event attestations: opaque integration and workflow references, trigger, decision (CONTINUE / UPDATE_INTEGRATION / HOLD), boolean flags, and occurred_at
• a SHA-256 digest of bearer credentials (hex digest of the UTF-8 token bytes). The plaintext bearer is not retained at rest.
• a SHA-256 client_hash of a verified request client identity. Process status CONFIGURED means EXACTLANE_TRUSTED_PROXY_PEERS and EXACTLANE_TRUSTED_CLIENT_IP_HEADER parse successfully; it does not mean every request has a usable identity. Public Agent Preview grant issuance (REST and MCP check_mcp_capability) additionally requires that the current socket peer is in that trusted set and that the configured header is present with exactly one canonicalizable IP. The documented Cloudflare path prefers CF-Connecting-IP. X-Forwarded-For is supported only when a trusted ingress overwrites it with one single valid IP. If the peer is untrusted, the header is missing, malformed, or multi-hop, REST POST /v0/public-access/grants fails closed with HTTP 503 PUBLIC_ACCESS_IDENTITY_UNAVAILABLE; MCP check_mcp_capability returns HTTP 200 with result.isError and structuredContent.error.code PUBLIC_ACCESS_IDENTITY_UNAVAILABLE. Neither hashes a shared loopback reverse-proxy peer. Non-public diagnostics may still record a canonical socket-peer hash. This value is used for issuance abuse control and MCP surface attribution comparison against known controlled windows. It is not sold and is not labeled anonymous. Raw IP addresses are not stored.
• issuance timestamps used for rate-limit and quota accounting
• idempotency records (route, request digest, and a redacted stored response) for 24 hours
• MCP surface telemetry rows (mcp_surface_events): the JSON-RPC method string as received, HTTP status, event kind, optional tool name, optional request id, optional JSON-RPC error code (rpc_error_code), optional bounded failure_code, and optional client_hash. This table does not store request bodies, Authorization headers, bearer tokens, token digests, capability snapshots, caller requirements, arbitrary headers, free-text error messages, or raw IP addresses.
• revision receipt diagnostic rows (revision_receipt_diagnostics) for POST /v0/revision-checks: the receipt digest, the digest of the check report issued with it, issue time, profile version, the credential's administrator-assigned traffic class, operator group reference and access kind, whether a previous report or receipt digest matched an earlier row, whether the snapshot digest changed, whether a structural change was found, whether the new capture time is later, the previous report's re-evaluation status, a reuse category, the seconds elapsed since the previous report's evaluation time, the conclusion transition, finding-change categories, and a reuse counter. This table does not store snapshots, requirements, reports, receipts, capability keys, revision labels, tool names, principal ids, client_hash values, or IP addresses. No public route returns or looks up its rows, and revision checks never depend on it. The bootstrap-administrator /admin view shows aggregate counts from it, plus the administrator-assigned operator group references of rows that meet the reuse review criteria.
• daily aggregate counts (daily_aggregates), computed from the records above after each UTC day ends: MCP surface events by event kind, HTTP status class and bounded failure code; grants issued; capability revisions, checks and usage attestations by access kind and traffic class, together with the check result and profile version, the usage trigger, decision and flags, and whether a snapshot matches one of Exactlane’s published examples; and how many distinct client_hash values appeared, including how many hit each failure code and how many of those later succeeded on the same day. These rows hold counts and fixed category labels only. They do not store a client_hash, IP address, bearer or token digest, display_label, agent, capability, check or request id, snapshot, requirements, report, tool name, or method string.

HTTP logs record request ID, method, path, status, and duration. The query string is not recorded, with one exception: a src link marker is recorded as a fixed label (one of Exactlane’s own link markers, internal for Exactlane’s own visits, or other), never as the text that was sent. A submission of the browser form on /preflight also records which form was used (example or lint) and a fixed result category (PASS, FAIL, UNSUPPORTED, other, LINT_CLEAN, LINT_FINDINGS, an HTTP error status (400, 413, 415, 429, or 503), or error), never the pasted text. A request may also carry an internal label that Exactlane’s own checks set with X-Exactlane-Internal: 1. Anyone can send that header, so the internal label is a hint only, never evidence. Logs exclude IP addresses, browser details, Authorization headers, request bodies, snapshots, requirements, and credentials. MCP surface telemetry write failures are logged as an internal event name and request id only; they do not change MCP responses.

Browser form on /preflight

The form on /preflight needs no account and uses no JavaScript or cookies. “Run the failing example” evaluates Exactlane’s fixed published example. Text pasted for a pre-check is processed in memory to build that one response and is not stored, logged, or used to issue a grant; the pre-check is a lint, not a compatibility check.

Public Agent Preview grants

Verified from the running service constants:

• lifetime: 1800 seconds (30 minutes)
• scopes (PUBLIC_PREVIEW_SCOPES): capabilities:write, capabilities:read, checks:write, checks:read, usage:write, self:delete. Preview grants do not receive bootstrap administrator scope.
• quotas per grant: capabilities 2, checks 3, usage_events 2
• issuance rate limits: 5 grants per client_hash per hour; 30 grants per client_hash per UTC day; 250 grants per hour globally as an emergency ceiling; 2000 grants per UTC day globally as an emergency ceiling. Issuance 429 responses include Retry-After
• the bearer is disclosed only on the original HTTP 201; exact Idempotency-Key replay for the same hashed client identity returns 200 without the token. Different hashed client identities use independent idempotency namespaces. Callers who share a hashed identity (NAT, VPN, or shared network egress) share that namespace
• disabled deployments return 403 PUBLIC_ACCESS_DISABLED
• Public Agent Preview REST POST /v0/public-access/grants with trusted-proxy identity UNCONFIGURED or INVALID, a request that cannot resolve a verified trusted-proxy client identity, or an absent/invalid client_hash, returns HTTP 503 PUBLIC_ACCESS_IDENTITY_UNAVAILABLE and does not issue a grant or mint PUBLIC_ACCESS:unattributed. MCP check_mcp_capability returns HTTP 200 with result.isError and the same error code; that MCP identity failure is not HTTP 503

Remote MCP

The Streamable HTTP adapter at https://exactlane.dev/mcp (POST only; tool check_mcp_capability) creates an internal Public Agent Preview grant, keeps the bearer inside the process, and revokes it in a finally block. MCP tool output is guarded so it does not include that bearer. The same grant quotas and issuance rate limits apply because the adapter uses the existing grant path. Stage-1 MCP surface telemetry records initialize, tools/list, tools/call start/result, and other JSON-RPC methods for entry/activation observation only. It does not change evaluator semantics, tool results, or official success metrics.

Retention

• capability revisions and check artifacts expire after about 30 days
• usage events expire after about 45 days
• usage occurred_at must fall within a 45-day window and not more than five minutes in the future
• idempotency records expire after 24 hours
• daily aggregate counts are kept for 400 days, so trends stay visible after the rows they were computed from expire. They are operator statistics, not official success metrics.
• MCP surface telemetry rows expire after 21 days. That early-market observation window is shorter than 30-day check artifacts and 45-day usage attestations because surface events are not finished-check evidence and are not official success metrics.
• revision receipt diagnostic rows expire after 60 days, which covers the eight-week review of revision-check reuse. Revision receipts are returned to the caller and are kept only inside the 24-hour idempotency record.
• expired private artifacts and rows are deleted during startup/maintenance cleanup

What Exactlane does not do

• no live probing and no fetching of caller-supplied URLs
• no sale of user data
• no public sharing or lookup endpoint for reports or revision receipts in this implementation

Infrastructure

When the hosted origin is reached through the current public deployment, Cloudflare may process connection metadata, including IP addresses, as edge, DNS, or tunnel infrastructure. Request URLs for public pages and CTAs (including a query src used to understand handoffs) may appear in those edge or access logs; human pages still do not use browser analytics tags. GitHub hosts the public discovery repository used for support issues; this service does not publish Preview snapshots or report artifacts there. Exactlane is listed on the Official MCP Registry as dev.exactlane/preflight (remote URL https://exactlane.dev/mcp, POST only). The Registry is a public discovery catalog; tool invocations still hit Exactlane’s own hosted service. Registry listing does not receive Preview bearers, capability snapshots, or check reports from Exactlane tool calls.

Contact

See /support.

Privacy treatment for paid Services

• Job information processed: contact details and correspondence you provide; submitted repo/package materials; synthetic examples; host/version details; diagnostic logs from the host-under-test run; reports; PRs; and payment records—used to quote, confirm, deliver, recheck, and administer the job by the agent team under human accountability.
• Exactlane-controlled working storage: materials Exactlane stores under its own control for the job (working copies, job logs, and working report drafts) are kept only as needed to perform and close the job, then removed from that working storage. This does not control retention by third parties.
• Third-party retention: material external services intentionally used for the job retain data under their own policies; those services are named in the service confirmation. Material external services may process job information outside Taiwan; applicable services are identified in the confirmation. Ordinary site infrastructure (for example Cloudflare on visits to the hosted site) is described in the Preflight privacy notices above and is not re-listed per job unless it is intentionally used as a job processor.
• Email / correspondence and payment records: kept as needed for accounting, tax, dispute, and legal record-keeping—not a per-job retention period filled into each confirmation.
• Host under test vs AI tooling: as in section 10 of the Services Terms—the named host run is compatibility testing of your server; the host provider may process materials under its own terms and privacy policy; agent tooling may process job materials for the report/PR; material external services for the job are listed in the confirmation.
• No sale: job information is not sold or added to marketing lists. Secrets are not requested; section 9 of the Services Terms applies.
• Site infrastructure: for visits to the current hosted site, Cloudflare may process connection metadata, including IP addresses, as edge, DNS or tunnel infrastructure, as described in the Preflight privacy notices above. Request URLs for public CTAs (including query src) may appear in edge/access logs to understand handoffs; there are still no browser analytics tags. Mail and issue channels used for Services are named in the service confirmation or on /contact and /support.
• Contact: hello@exactlane.dev for privacy, deletion, mismatch, cancellation, or refund requests.