{ "schema": "varexis-index-delivery/1", "catalog_version": "2026-10-16T14:13:51.913Z", "route_id": "agentic_pack_telemetry_redaction_v1", "question": "Telemetry redaction and data flow?", "answer": "Review where sensitive data can remain or leave a pipeline despite a redaction claim. Five dated documentation reviews cover OpenTelemetry exceptions, Vector error paths, Elastic licence skips, Presidio detection limits and Datadog scanning location. They keep configuration evidence and unresolved coverage questions with the source versions. They do not establish complete removal, regulatory compliance or permission to disclose data.", "records": [ { "record_id": "VXI-EXT-PROCUREMENT-OTEL-REDACTION-01-v1", "url": "/varexis-index/records/otel-redaction-allowlists-and-exception-precedence.json", "content_sha256": "b44a0c21a452a8663f9906e832de33c2c32a217daecd95f64e223619e3512953", "evidence": { "schema": "varexis-public-evidence-record/0.3", "generated_at_utc": "2026-10-16T14:13:51.913Z", "record_id": "VXI-EXT-PROCUREMENT-OTEL-REDACTION-01-v1", "record_kind": "external_reference", "title": "OpenTelemetry redaction: Exceptions and attribute scope", "system": "OpenTelemetry Collector", "evidence_family": "vendor_evidence_review", "index_status": "PUBLIC_SAFE_SOURCE_REVIEW", "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY", "canonical_question": "Does configuring the OpenTelemetry redaction processor prove every sensitive attribute is masked?", "near_questions": [ "Which attributes does the processor handle?", "Are any keys ignored without redaction?", "Do allowed values bypass masking?", "Is allow_all_keys enabled?", "Are blocked-value rules still applied?", "Which patterns match the actual data?", "Does a processor label prove complete removal?", "Were exception cases checked?", "What diagnostic attributes are emitted?", "Which exporter receives the result?", "Are other telemetry fields outside this claim?", "Can I preserve the redaction-policy review?" ], "supported_claims": [ { "claim": "The processor supports key and value policies with explicit exceptions. Ignored keys pass without redaction; allowed values are not masked. Enabling allow_all_keys disables the key allowlist but still applies blocked-value rules. Review the effective exceptions and processed attributes before treating the processor name as evidence of complete removal.", "reliance": "DOCUMENTED_CAPABILITY_ONLY" } ], "not_demonstrated_claims": [ "Verified buyer configuration or effective access rights", "Independent execution, completeness or security testing", "Vendor certification, legal compliance or guaranteed suitability" ], "public_summary": "The processor supports key and value policies with explicit exceptions. Ignored keys pass without redaction; allowed values are not masked. Enabling allow_all_keys disables the key allowlist but still applies blocked-value rules. Review the effective exceptions and processed attributes before treating the processor name as evidence of complete removal.", "related_record_ids": [], "source_review": { "source_type": "official_external_documentation", "source_title": "OpenTelemetry: Redaction processor", "source_url": "https://raw.githubusercontent.com/open-telemetry/opentelemetry-collector-contrib/main/processor/redactionprocessor/README.md", "checked_on": "2026-10-16", "candidate_record_id": "VXI-EXT-PROCUREMENT-OTEL-REDACTION-01-v1", "candidate_record_sha256": "af477065c0171a401f59720b851f8510e8c26a78e32e60418053492659a99caf", "method": "Primary documentation reviewed for the published bounded statement.", "deployment_tested_by_varexis": false, "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research." }, "answer_policy": { "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY", "bounded_answer": "The processor supports key and value policies with explicit exceptions. Ignored keys pass without redaction; allowed values are not masked. Enabling allow_all_keys disables the key allowlist but still applies blocked-value rules. Review the effective exceptions and processed attributes before treating the processor name as evidence of complete removal.", "required_buyer_context": "Collector version, processor configuration, attribute scope, exceptions and downstream destinations. Effective configuration and dated operational evidence have not been inspected.", "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state." }, "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.", "decision_profile": { "schema": "varexis-vendor-evidence-review/1", "review_status": "documentation_review_only", "checked_on": "2026-10-16", "claim_to_check": "Installing a redaction processor establishes complete sensitive-data removal.", "documented_statement": { "status": "documented", "statement": "The processor supports key and value policies with explicit exceptions. Ignored keys pass without redaction; allowed values are not masked. Enabling allow_all_keys disables the key allowlist but still applies blocked-value rules. Review the effective exceptions and processed attributes before treating the processor name as evidence of complete removal.", "source_ids": [ "otel" ] }, "buyer_evidence_required": [ "Collector revision and active processor configuration.", "Allowed, ignored and blocked keys or values.", "Representative output and all downstream paths." ], "review_condition": { "status": "varexis_review_policy", "statement": "Require evidence for exception paths and output scope before approving sensitive telemetry export." }, "unknowns": "The buyer configuration, contract, effective entitlement and operational evidence have not been inspected. Missing evidence does not establish absence or failure of the feature.", "evidence_sources": [ { "source_id": "otel", "url": "https://raw.githubusercontent.com/open-telemetry/opentelemetry-collector-contrib/main/processor/redactionprocessor/README.md", "final_url": "https://raw.githubusercontent.com/open-telemetry/opentelemetry-collector-contrib/main/processor/redactionprocessor/README.md", "title": "OpenTelemetry: Redaction processor", "checked_on": "2026-10-16", "sha256": "57b9a4f68bfe7a151300d3e2715bf682423d33334a927cd86d9e8b2273f8a0fe", "bytes": 18195 } ], "observed_deployment": false, "commercial_reliance_boundary": "Procurement evidence support only; no supplier clearance, legal conclusion, configuration audit or verification of the buyer's claim is supplied.", "paid_value": { "decision_context": "Save the specific policy exceptions behind a telemetry-disclosure decision.", "free": "Complete review, practical questions, sources and limitations; may be saved locally.", "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.", "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.", "excluded": [ "Fresh vendor research", "Continuous monitoring or change alerts", "Testing the buyer configuration", "Private evidence or vendor certification" ], "integrity": "Hashes identify content versions; they do not prove truth or provide a signature." }, "revalidation": { "trigger": "A saved purchase does not recheck the source or buyer configuration.", "specific_watch": "Collector version, processor configuration, attribute scope, exceptions and downstream destinations." } }, "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.", "service_route": { "request_guide": "/varexis-index/request.html", "request_workflow": "/varexis-index/request-workflow.json", "service_id": "single_request", "service_routes_url": "/varexis-index/service-routes.json", "payment_required": true, "availability_endpoint": "/api/index/capabilities", "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED", "checkout_url": "/index-access" }, "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.", "human_page": "/varexis-index/catalog.html#otel-redaction-allowlists-and-exception-precedence", "machine_readable_record": "/varexis-index/records/otel-redaction-allowlists-and-exception-precedence.json" } }, { "record_id": "VXI-EXT-PROCUREMENT-VECTOR-REMAP-FAILURE-01-v1", "url": "/varexis-index/records/vector-remap-error-path-original-event-disclosure.json", "content_sha256": "03ed169e40702ccec6621e2be773241f62d15bf69f54cfeda7baf5e2f026aae2", "evidence": { "schema": "varexis-public-evidence-record/0.3", "generated_at_utc": "2026-10-16T14:13:51.913Z", "record_id": "VXI-EXT-PROCUREMENT-VECTOR-REMAP-FAILURE-01-v1", "record_kind": "external_reference", "title": "Vector remap: Failed redaction and original events", "system": "Vector remap", "evidence_family": "vendor_evidence_review", "index_status": "PUBLIC_SAFE_SOURCE_REVIEW", "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY", "canonical_question": "Can a Vector remap error send the original sensitive event downstream?", "near_questions": [ "What happens if the remap program errors?", "Is drop_on_error explicitly set?", "Does an abort use a different setting?", "Can the original event be forwarded?", "Where do rerouted dropped events go?", "Does that output contain unredacted data?", "Were failure cases tested?", "Can an enrichment error bypass a required transformation?", "Who can read the error sink?", "Is the normal output the only export path?", "Which configuration was reviewed?", "Can I save the failure-path evidence?" ], "supported_claims": [ { "claim": "By default, a processing error forwards the original unmodified event because drop_on_error is false. Explicit aborts have a separate drop_on_abort setting. Rerouted dropped events can also carry original data. Review normal, error and dropped outputs separately before relying on a remap transformation as a disclosure barrier.", "reliance": "DOCUMENTED_CAPABILITY_ONLY" } ], "not_demonstrated_claims": [ "Verified buyer configuration or effective access rights", "Independent execution, completeness or security testing", "Vendor certification, legal compliance or guaranteed suitability" ], "public_summary": "By default, a processing error forwards the original unmodified event because drop_on_error is false. Explicit aborts have a separate drop_on_abort setting. Rerouted dropped events can also carry original data. Review normal, error and dropped outputs separately before relying on a remap transformation as a disclosure barrier.", "related_record_ids": [], "source_review": { "source_type": "official_external_documentation", "source_title": "Vector: Remap transform", "source_url": "https://vector.dev/docs/reference/configuration/transforms/remap/", "checked_on": "2026-10-16", "candidate_record_id": "VXI-EXT-PROCUREMENT-VECTOR-REMAP-FAILURE-01-v1", "candidate_record_sha256": "c30a192c55f6f9a5c68a2dd997ed1d903c05b6db42a8cb9b3fbbe416f19658de", "method": "Primary documentation reviewed for the published bounded statement.", "deployment_tested_by_varexis": false, "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research." }, "answer_policy": { "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY", "bounded_answer": "By default, a processing error forwards the original unmodified event because drop_on_error is false. Explicit aborts have a separate drop_on_abort setting. Rerouted dropped events can also carry original data. Review normal, error and dropped outputs separately before relying on a remap transformation as a disclosure barrier.", "required_buyer_context": "Vector revision, remap configuration, failure inputs and every output destination. Effective configuration and dated operational evidence have not been inspected.", "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state." }, "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.", "decision_profile": { "schema": "varexis-vendor-evidence-review/1", "review_status": "documentation_review_only", "checked_on": "2026-10-16", "claim_to_check": "A remap redaction program prevents raw data from leaving on every path.", "documented_statement": { "status": "documented", "statement": "By default, a processing error forwards the original unmodified event because drop_on_error is false. Explicit aborts have a separate drop_on_abort setting. Rerouted dropped events can also carry original data. Review normal, error and dropped outputs separately before relying on a remap transformation as a disclosure barrier.", "source_ids": [ "vector" ] }, "buyer_evidence_required": [ "Effective drop_on_error and drop_on_abort settings.", "Rerouted-output destinations and access controls.", "Failure-case output for representative inputs." ], "review_condition": { "status": "varexis_review_policy", "statement": "Do not approve a no-raw-data claim without reviewing error and reroute paths." }, "unknowns": "The buyer configuration, contract, effective entitlement and operational evidence have not been inspected. Missing evidence does not establish absence or failure of the feature.", "evidence_sources": [ { "source_id": "vector", "url": "https://vector.dev/docs/reference/configuration/transforms/remap/", "final_url": "https://vector.dev/docs/reference/configuration/transforms/remap/", "title": "Vector: Remap transform", "checked_on": "2026-10-16", "sha256": "d7b6dd4987ed5bfc0ba0aaf210b2f02f056a13371247082749f5aaee5388e291", "bytes": 255870 } ], "observed_deployment": false, "commercial_reliance_boundary": "Procurement evidence support only; no supplier clearance, legal conclusion, configuration audit or verification of the buyer's claim is supplied.", "paid_value": { "decision_context": "Preserve the failure-path questions behind a log-processing purchase.", "free": "Complete review, practical questions, sources and limitations; may be saved locally.", "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.", "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.", "excluded": [ "Fresh vendor research", "Continuous monitoring or change alerts", "Testing the buyer configuration", "Private evidence or vendor certification" ], "integrity": "Hashes identify content versions; they do not prove truth or provide a signature." }, "revalidation": { "trigger": "A saved purchase does not recheck the source or buyer configuration.", "specific_watch": "Vector revision, remap configuration, failure inputs and every output destination." } }, "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.", "service_route": { "request_guide": "/varexis-index/request.html", "request_workflow": "/varexis-index/request-workflow.json", "service_id": "single_request", "service_routes_url": "/varexis-index/service-routes.json", "payment_required": true, "availability_endpoint": "/api/index/capabilities", "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED", "checkout_url": "/index-access" }, "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.", "human_page": "/varexis-index/catalog.html#vector-remap-error-path-original-event-disclosure", "machine_readable_record": "/varexis-index/records/vector-remap-error-path-original-event-disclosure.json" } }, { "record_id": "VXI-EXT-PROCUREMENT-ELASTIC-REDACT-LICENCE-01-v1", "url": "/varexis-index/records/elastic-redact-licence-skip-and-failure-policy.json", "content_sha256": "81e27f416a73a1c4e83916fa20bb10d7a88532bc65b448cd67b288503d6ae608", "evidence": { "schema": "varexis-public-evidence-record/0.3", "generated_at_utc": "2026-10-16T14:13:51.913Z", "record_id": "VXI-EXT-PROCUREMENT-ELASTIC-REDACT-LICENCE-01-v1", "record_kind": "external_reference", "title": "Elasticsearch redaction: Licence and skip behaviour", "system": "Elasticsearch ingest", "evidence_family": "vendor_evidence_review", "index_status": "PUBLIC_SAFE_SOURCE_REVIEW", "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY", "canonical_question": "Does a successful ingest pipeline prove the redact processor changed the document?", "near_questions": [ "Is the redact processor licensed?", "Is skip_if_unlicensed enabled?", "Can it exit without changing the document?", "Does a condition skip processing?", "Are processor failures ignored?", "What does on_failure do with the original data?", "Was trace_redact enabled?", "Did the intended field change?", "Which Grok patterns were applied?", "Can unmatched content remain?", "What evidence supports the export decision?", "Can I retain the pipeline review?" ], "supported_claims": [ { "claim": "The redact processor can quietly leave a document unchanged when skip_if_unlicensed is enabled and the licence does not support it. Conditional execution and failure handling also affect what runs. The trace_redact option can mark actual redaction, but absence of that marker alone is not a complete coverage assessment.", "reliance": "DOCUMENTED_CAPABILITY_ONLY" } ], "not_demonstrated_claims": [ "Verified buyer configuration or effective access rights", "Independent execution, completeness or security testing", "Vendor certification, legal compliance or guaranteed suitability" ], "public_summary": "The redact processor can quietly leave a document unchanged when skip_if_unlicensed is enabled and the licence does not support it. Conditional execution and failure handling also affect what runs. The trace_redact option can mark actual redaction, but absence of that marker alone is not a complete coverage assessment.", "related_record_ids": [], "source_review": { "source_type": "official_external_documentation", "source_title": "Elasticsearch: Redact processor", "source_url": "https://www.elastic.co/docs/reference/ingest-processor/redact-processor", "checked_on": "2026-10-16", "candidate_record_id": "VXI-EXT-PROCUREMENT-ELASTIC-REDACT-LICENCE-01-v1", "candidate_record_sha256": "99ed19a8162abdf17fa5b3f32df548b84f07afe77bcef8247cad46286f354cdd", "method": "Primary documentation reviewed for the published bounded statement.", "deployment_tested_by_varexis": false, "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research." }, "answer_policy": { "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY", "bounded_answer": "The redact processor can quietly leave a document unchanged when skip_if_unlicensed is enabled and the licence does not support it. Conditional execution and failure handling also affect what runs. The trace_redact option can mark actual redaction, but absence of that marker alone is not a complete coverage assessment.", "required_buyer_context": "Elasticsearch version, licence, processor settings, patterns and failure paths. Effective configuration and dated operational evidence have not been inspected.", "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state." }, "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.", "decision_profile": { "schema": "varexis-vendor-evidence-review/1", "review_status": "documentation_review_only", "checked_on": "2026-10-16", "claim_to_check": "Pipeline success proves sensitive text was redacted.", "documented_statement": { "status": "documented", "statement": "The redact processor can quietly leave a document unchanged when skip_if_unlicensed is enabled and the licence does not support it. Conditional execution and failure handling also affect what runs. The trace_redact option can mark actual redaction, but absence of that marker alone is not a complete coverage assessment.", "source_ids": [ "elastic" ] }, "buyer_evidence_required": [ "Licence eligibility and effective skip settings.", "Conditional and failure-handler configuration.", "Representative input/output and redaction trace where enabled." ], "review_condition": { "status": "varexis_review_policy", "statement": "Check actual processor execution and output before accepting pipeline success as redaction evidence." }, "unknowns": "The buyer configuration, contract, effective entitlement and operational evidence have not been inspected. Missing evidence does not establish absence or failure of the feature.", "evidence_sources": [ { "source_id": "elastic", "url": "https://www.elastic.co/docs/reference/ingest-processor/redact-processor", "final_url": "https://www.elastic.co/docs/reference/ingest-processor/redact-processor", "title": "Elasticsearch: Redact processor", "checked_on": "2026-10-16", "sha256": "4cfce3522371e211b4b30e2e7f3b9068a33ca5eb3d1a4be8076c2fbf3b027c5d", "bytes": 2007651 } ], "observed_deployment": false, "commercial_reliance_boundary": "Procurement evidence support only; no supplier clearance, legal conclusion, configuration audit or verification of the buyer's claim is supplied.", "paid_value": { "decision_context": "Save the execution and licensing boundary behind a redaction claim.", "free": "Complete review, practical questions, sources and limitations; may be saved locally.", "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.", "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.", "excluded": [ "Fresh vendor research", "Continuous monitoring or change alerts", "Testing the buyer configuration", "Private evidence or vendor certification" ], "integrity": "Hashes identify content versions; they do not prove truth or provide a signature." }, "revalidation": { "trigger": "A saved purchase does not recheck the source or buyer configuration.", "specific_watch": "Elasticsearch version, licence, processor settings, patterns and failure paths." } }, "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.", "service_route": { "request_guide": "/varexis-index/request.html", "request_workflow": "/varexis-index/request-workflow.json", "service_id": "single_request", "service_routes_url": "/varexis-index/service-routes.json", "payment_required": true, "availability_endpoint": "/api/index/capabilities", "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED", "checkout_url": "/index-access" }, "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.", "human_page": "/varexis-index/catalog.html#elastic-redact-licence-skip-and-failure-policy", "machine_readable_record": "/varexis-index/records/elastic-redact-licence-skip-and-failure-policy.json" } }, { "record_id": "VXI-EXT-PROCUREMENT-PRESIDIO-COVERAGE-01-v1", "url": "/varexis-index/records/presidio-detection-coverage-not-complete-anonymization.json", "content_sha256": "6697b6d2b6d896c5ccbe60d3495e318780ede8efc0355ddc4a19ad043a41059c", "evidence": { "schema": "varexis-public-evidence-record/0.3", "generated_at_utc": "2026-10-16T14:13:51.913Z", "record_id": "VXI-EXT-PROCUREMENT-PRESIDIO-COVERAGE-01-v1", "record_kind": "external_reference", "title": "Presidio: Detection coverage and residual information", "system": "Presidio", "evidence_family": "vendor_evidence_review", "index_status": "PUBLIC_SAFE_SOURCE_REVIEW", "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY", "canonical_question": "Does a clean Presidio result prove a document contains no sensitive information?", "near_questions": [ "Which recognizers were enabled?", "Which model processed the text?", "Was an external model used?", "Does the configuration cover our language?", "Were image inputs handled separately?", "Can sensitive information be missed?", "Does zero entities mean no personal data?", "Were domain-specific identifiers considered?", "Which residual checks were performed?", "Who authorized disclosure of the output?", "What revision and configuration produced the result?", "Can I preserve the detection-limit review?" ], "supported_claims": [ { "claim": "Presidio combines configurable recognizers and can use external detection models. Its maintainers explicitly warn that automated detection does not find all sensitive information. The selected recognizers, languages and input types need buyer validation; a clean result cannot alone establish complete anonymization or permission to disclose the document.", "reliance": "DOCUMENTED_CAPABILITY_ONLY" } ], "not_demonstrated_claims": [ "Verified buyer configuration or effective access rights", "Independent execution, completeness or security testing", "Vendor certification, legal compliance or guaranteed suitability" ], "public_summary": "Presidio combines configurable recognizers and can use external detection models. Its maintainers explicitly warn that automated detection does not find all sensitive information. The selected recognizers, languages and input types need buyer validation; a clean result cannot alone establish complete anonymization or permission to disclose the document.", "related_record_ids": [], "source_review": { "source_type": "official_external_documentation", "source_title": "Presidio: Detection scope and limitations", "source_url": "https://raw.githubusercontent.com/data-privacy-stack/presidio/main/README.MD", "checked_on": "2026-10-16", "candidate_record_id": "VXI-EXT-PROCUREMENT-PRESIDIO-COVERAGE-01-v1", "candidate_record_sha256": "3a10f81709892991d700047e7eddb9f788a5f3b7bcb1c677ec5005019ef2c3da", "method": "Primary documentation reviewed for the published bounded statement.", "deployment_tested_by_varexis": false, "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research." }, "answer_policy": { "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY", "bounded_answer": "Presidio combines configurable recognizers and can use external detection models. Its maintainers explicitly warn that automated detection does not find all sensitive information. The selected recognizers, languages and input types need buyer validation; a clean result cannot alone establish complete anonymization or permission to disclose the document.", "required_buyer_context": "Presidio revision, recognizers, models, languages, input types and disclosure purpose. Effective configuration and dated operational evidence have not been inspected.", "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state." }, "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.", "decision_profile": { "schema": "varexis-vendor-evidence-review/1", "review_status": "documentation_review_only", "checked_on": "2026-10-16", "claim_to_check": "No detected entities means a document is safe to disclose.", "documented_statement": { "status": "documented", "statement": "Presidio combines configurable recognizers and can use external detection models. Its maintainers explicitly warn that automated detection does not find all sensitive information. The selected recognizers, languages and input types need buyer validation; a clean result cannot alone establish complete anonymization or permission to disclose the document.", "source_ids": [ "presidio" ] }, "buyer_evidence_required": [ "Recognizer and model configuration.", "Representative language and input-type coverage.", "Residual-data review and authorized disclosure scope." ], "review_condition": { "status": "varexis_review_policy", "statement": "Require additional protections and relevant coverage evidence before relying on complete removal." }, "unknowns": "The buyer configuration, contract, effective entitlement and operational evidence have not been inspected. Missing evidence does not establish absence or failure of the feature.", "evidence_sources": [ { "source_id": "presidio", "url": "https://raw.githubusercontent.com/data-privacy-stack/presidio/main/README.MD", "final_url": "https://raw.githubusercontent.com/data-privacy-stack/presidio/main/README.MD", "title": "Presidio: Detection scope and limitations", "checked_on": "2026-10-16", "sha256": "b553970feb389eaa4cb4a09362ee1a5825e4844a63ea2a2d729c6fca18a140e0", "bytes": 6722 } ], "observed_deployment": false, "commercial_reliance_boundary": "Procurement evidence support only; no supplier clearance, legal conclusion, configuration audit or verification of the buyer's claim is supplied.", "paid_value": { "decision_context": "Retain the detection limits used when reviewing a privacy-processing workflow.", "free": "Complete review, practical questions, sources and limitations; may be saved locally.", "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.", "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.", "excluded": [ "Fresh vendor research", "Continuous monitoring or change alerts", "Testing the buyer configuration", "Private evidence or vendor certification" ], "integrity": "Hashes identify content versions; they do not prove truth or provide a signature." }, "revalidation": { "trigger": "A saved purchase does not recheck the source or buyer configuration.", "specific_watch": "Presidio revision, recognizers, models, languages, input types and disclosure purpose." } }, "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.", "service_route": { "request_guide": "/varexis-index/request.html", "request_workflow": "/varexis-index/request-workflow.json", "service_id": "single_request", "service_routes_url": "/varexis-index/service-routes.json", "payment_required": true, "availability_endpoint": "/api/index/capabilities", "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED", "checkout_url": "/index-access" }, "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.", "human_page": "/varexis-index/catalog.html#presidio-detection-coverage-not-complete-anonymization", "machine_readable_record": "/varexis-index/records/presidio-detection-coverage-not-complete-anonymization.json" } }, { "record_id": "VXI-EXT-PROCUREMENT-DATADOG-SCAN-LOCATION-01-v1", "url": "/varexis-index/records/datadog-sensitive-scanner-redaction-location.json", "content_sha256": "5a93c24d98bb9045bd6e792485f8232fbda070a3bcf3aaee67e9a6350245ece5", "evidence": { "schema": "varexis-public-evidence-record/0.3", "generated_at_utc": "2026-10-16T13:36:43.315Z", "record_id": "VXI-EXT-PROCUREMENT-DATADOG-SCAN-LOCATION-01-v1", "record_kind": "external_reference", "title": "Datadog scanning: Redaction location and sampling", "system": "Datadog", "evidence_family": "vendor_evidence_review", "index_status": "PUBLIC_SAFE_SOURCE_REVIEW", "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY", "canonical_question": "Does Datadog sensitive-data scanning prove raw content never leaves our environment?", "near_questions": [ "Does cloud scanning happen before data leaves us?", "Can scanning run within our environment?", "Which fields are scanned for APM?", "Are RUM bodies and attributes treated alike?", "Is sampling enabled?", "Does every event pass the same rule set?", "Is a redacted UI evidence of source-side filtering?", "Which log fields are scanned?", "Are all products configured separately?", "What happens to unselected data fields?", "What should procurement request about data flow?", "Can I retain the scanner-location review?" ], "supported_claims": [ { "claim": "Cloud scanning receives data in the Datadog backend before redaction. Scanning within the customer environment is a different deployment choice. The supported fields differ across logs, APM, RUM and events, and optional sampling reduces the scanned fraction. A masked interface alone does not establish pre-egress redaction or complete coverage.", "reliance": "DOCUMENTED_CAPABILITY_ONLY" } ], "not_demonstrated_claims": [ "Verified buyer configuration or effective access rights", "Independent execution, completeness or security testing", "Vendor certification, legal compliance or guaranteed suitability" ], "public_summary": "Cloud scanning receives data in the Datadog backend before redaction. Scanning within the customer environment is a different deployment choice. The supported fields differ across logs, APM, RUM and events, and optional sampling reduces the scanned fraction. A masked interface alone does not establish pre-egress redaction or complete coverage.", "related_record_ids": [], "source_review": { "source_type": "official_external_documentation", "source_title": "Datadog Sensitive Data Scanner", "source_url": "https://docs.datadoghq.com/security/sensitive_data_scanner/", "checked_on": "2026-10-16", "candidate_record_id": "VXI-EXT-PROCUREMENT-DATADOG-SCAN-LOCATION-01-v1", "candidate_record_sha256": "bf05110b5a7e790b53c44ab95234d824e4ed3a488b08361d44daaa1bb57c93c9", "method": "Primary documentation reviewed for the published bounded statement.", "deployment_tested_by_varexis": false, "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research." }, "answer_policy": { "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY", "bounded_answer": "Cloud scanning receives data in the Datadog backend before redaction. Scanning within the customer environment is a different deployment choice. The supported fields differ across logs, APM, RUM and events, and optional sampling reduces the scanned fraction. A masked interface alone does not establish pre-egress redaction or complete coverage.", "required_buyer_context": "Scanner placement, product, selected fields, rules and sampling. Effective configuration and dated operational evidence have not been inspected.", "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state." }, "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.", "decision_profile": { "schema": "varexis-vendor-evidence-review/1", "review_status": "documentation_review_only", "checked_on": "2026-10-16", "claim_to_check": "A redacted Datadog view proves all sensitive data was removed before transmission.", "documented_statement": { "status": "documented", "statement": "Cloud scanning receives data in the Datadog backend before redaction. Scanning within the customer environment is a different deployment choice. The supported fields differ across logs, APM, RUM and events, and optional sampling reduces the scanned fraction. A masked interface alone does not establish pre-egress redaction or complete coverage.", "source_ids": [ "datadog" ] }, "buyer_evidence_required": [ "Scanner location and data-flow diagram.", "Product-specific fields, rules and sampling.", "Evidence from the source-side pipeline." ], "review_condition": { "status": "varexis_review_policy", "statement": "Require source-side evidence before describing redaction as pre-egress." }, "unknowns": "The buyer configuration, contract, effective entitlement and operational evidence have not been inspected. Missing evidence does not establish absence or failure of the feature.", "evidence_sources": [ { "source_id": "datadog", "url": "https://docs.datadoghq.com/security/sensitive_data_scanner/", "final_url": "https://docs.datadoghq.com/security/sensitive_data_scanner/", "title": "Datadog Sensitive Data Scanner", "checked_on": "2026-10-16", "sha256": "c222da5da964ac4383a8409452fe9fcb397276d51544ad928b4c7b3a4d33cb53", "bytes": 808843 } ], "observed_deployment": false, "commercial_reliance_boundary": "Procurement evidence support only; no supplier clearance, legal conclusion, configuration audit or verification of the buyer's claim is supplied.", "paid_value": { "decision_context": "Save the evidence questions for a supplier data-disclosure review.", "free": "Complete review, practical questions, sources and limitations; may be saved locally.", "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.", "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.", "excluded": [ "Fresh vendor research", "Continuous monitoring or change alerts", "Testing the buyer configuration", "Private evidence or vendor certification" ], "integrity": "Hashes identify content versions; they do not prove truth or provide a signature." }, "revalidation": { "trigger": "A saved purchase does not recheck the source or buyer configuration.", "specific_watch": "Scanner placement, product, selected fields, rules and sampling." } }, "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.", "service_route": { "request_guide": "/varexis-index/request.html", "request_workflow": "/varexis-index/request-workflow.json", "service_id": "single_request", "service_routes_url": "/varexis-index/service-routes.json", "payment_required": true, "availability_endpoint": "/api/index/capabilities", "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED", "checkout_url": "/index-access" }, "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.", "human_page": "/varexis-index/catalog.html#datadog-sensitive-scanner-redaction-location", "machine_readable_record": "/varexis-index/records/datadog-sensitive-scanner-redaction-location.json" } } ], "basis": "A frozen compilation of existing public documentation reviews and their source bindings. No new source review, tool execution, independent experiment or buyer assessment was performed for this package.", "boundary": "Public answers remain free. Payment provides automatic retrieval, version binding and a saved delivery. It does not upgrade evidence or disclose protected material. The saved pack is not continually refreshed. Hashes bind its contents; the optional delivery receipt is unsigned.", "pack": { "schema": "varexis-index-evidence-pack/1", "pack_id": "telemetry-redaction", "version": "1.0.0", "title": "Telemetry Redaction — Coverage, Exceptions & Data Flow", "prepared_at_utc": "2026-10-16T14:43:10.377Z", "review_status": "documentation_review_only", "source_checked_on": [ "2026-10-16" ], "source_capture_date": null, "source_capture_boundary": "Existing dated review and upstream hash metadata are preserved. No new source bytes were acquired for this compilation; separate capture timestamps and independently tested runtime versions are not established.", "summary_markdown": "# Telemetry Redaction — Coverage, Exceptions & Data Flow\n\nUse this pack when reviewing a supplier claim that telemetry or document content is redacted. Trace the processing location, exceptions, error outputs and detector coverage separately. These products operate at different stages and are not interchangeable. The pack records questions for the buyer to resolve; it does not inspect the buyer pipeline.\n\n## OpenTelemetry redaction: Exceptions and attribute scope\nThe processor supports key and value policies with explicit exceptions. Ignored keys pass without redaction; allowed values are not masked. Enabling allow_all_keys disables the key allowlist but still applies blocked-value rules. Review the effective exceptions and processed attributes before treating the processor name as evidence of complete removal.\n\nReviewed: 2026-10-16. Documentation review only.\n\nEvidence still needed: Collector revision and active processor configuration. Allowed, ignored and blocked keys or values. Representative output and all downstream paths.\n\n## Vector remap: Failed redaction and original events\nBy default, a processing error forwards the original unmodified event because drop_on_error is false. Explicit aborts have a separate drop_on_abort setting. Rerouted dropped events can also carry original data. Review normal, error and dropped outputs separately before relying on a remap transformation as a disclosure barrier.\n\nReviewed: 2026-10-16. Documentation review only.\n\nEvidence still needed: Effective drop_on_error and drop_on_abort settings. Rerouted-output destinations and access controls. Failure-case output for representative inputs.\n\n## Elasticsearch redaction: Licence and skip behaviour\nThe redact processor can quietly leave a document unchanged when skip_if_unlicensed is enabled and the licence does not support it. Conditional execution and failure handling also affect what runs. The trace_redact option can mark actual redaction, but absence of that marker alone is not a complete coverage assessment.\n\nReviewed: 2026-10-16. Documentation review only.\n\nEvidence still needed: Licence eligibility and effective skip settings. Conditional and failure-handler configuration. Representative input/output and redaction trace where enabled.\n\n## Presidio: Detection coverage and residual information\nPresidio combines configurable recognizers and can use external detection models. Its maintainers explicitly warn that automated detection does not find all sensitive information. The selected recognizers, languages and input types need buyer validation; a clean result cannot alone establish complete anonymization or permission to disclose the document.\n\nReviewed: 2026-10-16. Documentation review only.\n\nEvidence still needed: Recognizer and model configuration. Representative language and input-type coverage. Residual-data review and authorized disclosure scope.\n\n## Datadog scanning: Redaction location and sampling\nCloud scanning receives data in the Datadog backend before redaction. Scanning within the customer environment is a different deployment choice. The supported fields differ across logs, APM, RUM and events, and optional sampling reduces the scanned fraction. A masked interface alone does not establish pre-egress redaction or complete coverage.\n\nReviewed: 2026-10-16. Documentation review only.\n\nEvidence still needed: Scanner location and data-flow diagram. Product-specific fields, rules and sampling. Evidence from the source-side pipeline.\n\n## What payment adds\nThe entire pack is free to inspect or save locally. Single Request (GBP 5 plus applicable VAT) saves this complete version-bound JSON as one retrievable result. Evidence Receipt (GBP 19 plus applicable VAT) adds an unsigned delivery receipt. Eligible subscriptions use one query for the whole pack, not one per member. Keep the original access key and query reference for recovery; do not purchase again after uncertain payment.\n\n## Scope\nSource dates, documented claims, review considerations and unknowns remain distinct. No fresh investigation, buyer configuration test, certification, legal conclusion, continual refresh or permanent-retention commitment is included. Hashes bind content, not truth or independent assurance.\n", "comparison": [ { "record_id": "VXI-EXT-PROCUREMENT-OTEL-REDACTION-01-v1", "subject": "OpenTelemetry Collector", "review_status": "documentation_review_only", "checked_on": "2026-10-16", "claim_to_check": "Installing a redaction processor establishes complete sensitive-data removal.", "documented_statement": { "status": "documented", "statement": "The processor supports key and value policies with explicit exceptions. Ignored keys pass without redaction; allowed values are not masked. Enabling allow_all_keys disables the key allowlist but still applies blocked-value rules. Review the effective exceptions and processed attributes before treating the processor name as evidence of complete removal.", "source_ids": [ "otel" ] }, "buyer_evidence_required": [ "Collector revision and active processor configuration.", "Allowed, ignored and blocked keys or values.", "Representative output and all downstream paths." ], "review_condition": { "status": "varexis_review_policy", "statement": "Require evidence for exception paths and output scope before approving sensitive telemetry export." }, "unknowns": "The buyer configuration, contract, effective entitlement and operational evidence have not been inspected. Missing evidence does not establish absence or failure of the feature." }, { "record_id": "VXI-EXT-PROCUREMENT-VECTOR-REMAP-FAILURE-01-v1", "subject": "Vector remap", "review_status": "documentation_review_only", "checked_on": "2026-10-16", "claim_to_check": "A remap redaction program prevents raw data from leaving on every path.", "documented_statement": { "status": "documented", "statement": "By default, a processing error forwards the original unmodified event because drop_on_error is false. Explicit aborts have a separate drop_on_abort setting. Rerouted dropped events can also carry original data. Review normal, error and dropped outputs separately before relying on a remap transformation as a disclosure barrier.", "source_ids": [ "vector" ] }, "buyer_evidence_required": [ "Effective drop_on_error and drop_on_abort settings.", "Rerouted-output destinations and access controls.", "Failure-case output for representative inputs." ], "review_condition": { "status": "varexis_review_policy", "statement": "Do not approve a no-raw-data claim without reviewing error and reroute paths." }, "unknowns": "The buyer configuration, contract, effective entitlement and operational evidence have not been inspected. Missing evidence does not establish absence or failure of the feature." }, { "record_id": "VXI-EXT-PROCUREMENT-ELASTIC-REDACT-LICENCE-01-v1", "subject": "Elasticsearch ingest", "review_status": "documentation_review_only", "checked_on": "2026-10-16", "claim_to_check": "Pipeline success proves sensitive text was redacted.", "documented_statement": { "status": "documented", "statement": "The redact processor can quietly leave a document unchanged when skip_if_unlicensed is enabled and the licence does not support it. Conditional execution and failure handling also affect what runs. The trace_redact option can mark actual redaction, but absence of that marker alone is not a complete coverage assessment.", "source_ids": [ "elastic" ] }, "buyer_evidence_required": [ "Licence eligibility and effective skip settings.", "Conditional and failure-handler configuration.", "Representative input/output and redaction trace where enabled." ], "review_condition": { "status": "varexis_review_policy", "statement": "Check actual processor execution and output before accepting pipeline success as redaction evidence." }, "unknowns": "The buyer configuration, contract, effective entitlement and operational evidence have not been inspected. Missing evidence does not establish absence or failure of the feature." }, { "record_id": "VXI-EXT-PROCUREMENT-PRESIDIO-COVERAGE-01-v1", "subject": "Presidio", "review_status": "documentation_review_only", "checked_on": "2026-10-16", "claim_to_check": "No detected entities means a document is safe to disclose.", "documented_statement": { "status": "documented", "statement": "Presidio combines configurable recognizers and can use external detection models. Its maintainers explicitly warn that automated detection does not find all sensitive information. The selected recognizers, languages and input types need buyer validation; a clean result cannot alone establish complete anonymization or permission to disclose the document.", "source_ids": [ "presidio" ] }, "buyer_evidence_required": [ "Recognizer and model configuration.", "Representative language and input-type coverage.", "Residual-data review and authorized disclosure scope." ], "review_condition": { "status": "varexis_review_policy", "statement": "Require additional protections and relevant coverage evidence before relying on complete removal." }, "unknowns": "The buyer configuration, contract, effective entitlement and operational evidence have not been inspected. Missing evidence does not establish absence or failure of the feature." }, { "record_id": "VXI-EXT-PROCUREMENT-DATADOG-SCAN-LOCATION-01-v1", "subject": "Datadog", "review_status": "documentation_review_only", "checked_on": "2026-10-16", "claim_to_check": "A redacted Datadog view proves all sensitive data was removed before transmission.", "documented_statement": { "status": "documented", "statement": "Cloud scanning receives data in the Datadog backend before redaction. Scanning within the customer environment is a different deployment choice. The supported fields differ across logs, APM, RUM and events, and optional sampling reduces the scanned fraction. A masked interface alone does not establish pre-egress redaction or complete coverage.", "source_ids": [ "datadog" ] }, "buyer_evidence_required": [ "Scanner location and data-flow diagram.", "Product-specific fields, rules and sampling.", "Evidence from the source-side pipeline." ], "review_condition": { "status": "varexis_review_policy", "statement": "Require source-side evidence before describing redaction as pre-egress." }, "unknowns": "The buyer configuration, contract, effective entitlement and operational evidence have not been inspected. Missing evidence does not establish absence or failure of the feature." } ], "members": [ { "schema": "varexis-index-delivery/1", "catalog_version": "2026-10-16T14:13:51.913Z", "route_id": "agentic_reviewed_otel_redaction_allowlists_and_exception_precedence", "question": "Does configuring the OpenTelemetry redaction processor prove every sensitive attribute is masked?", "answer": "The processor supports key and value policies with explicit exceptions. Ignored keys pass without redaction; allowed values are not masked. Enabling allow_all_keys disables the key allowlist but still applies blocked-value rules. Review the effective exceptions and processed attributes before treating the processor name as evidence of complete removal.", "basis": "A saved snapshot of the reviewed public route and source records. No fresh source review, independent experiment, deployment assessment or bespoke claim analysis is performed by this delivery.", "boundary": "Public answers remain free. Payment provides automatic retrieval, version binding and a saved delivery. It does not upgrade evidence or disclose protected material.", "snapshot_sha256": "b4c6e80663400dd87e09e446d66b2c4bba78c8ad990813474d1726a838806275", "record_ids": [ "VXI-EXT-PROCUREMENT-OTEL-REDACTION-01-v1" ] }, { "schema": "varexis-index-delivery/1", "catalog_version": "2026-10-16T14:13:51.913Z", "route_id": "agentic_reviewed_vector_remap_error_path_original_event_disclosure", "question": "Can a Vector remap error send the original sensitive event downstream?", "answer": "By default, a processing error forwards the original unmodified event because drop_on_error is false. Explicit aborts have a separate drop_on_abort setting. Rerouted dropped events can also carry original data. Review normal, error and dropped outputs separately before relying on a remap transformation as a disclosure barrier.", "basis": "A saved snapshot of the reviewed public route and source records. No fresh source review, independent experiment, deployment assessment or bespoke claim analysis is performed by this delivery.", "boundary": "Public answers remain free. Payment provides automatic retrieval, version binding and a saved delivery. It does not upgrade evidence or disclose protected material.", "snapshot_sha256": "d8f5668f9ae21439a790e5dc113c28340f5cb33bfc1c682c66c4c890931e0680", "record_ids": [ "VXI-EXT-PROCUREMENT-VECTOR-REMAP-FAILURE-01-v1" ] }, { "schema": "varexis-index-delivery/1", "catalog_version": "2026-10-16T14:13:51.913Z", "route_id": "agentic_reviewed_elastic_redact_licence_skip_and_failure_policy", "question": "Does a successful ingest pipeline prove the redact processor changed the document?", "answer": "The redact processor can quietly leave a document unchanged when skip_if_unlicensed is enabled and the licence does not support it. Conditional execution and failure handling also affect what runs. The trace_redact option can mark actual redaction, but absence of that marker alone is not a complete coverage assessment.", "basis": "A saved snapshot of the reviewed public route and source records. No fresh source review, independent experiment, deployment assessment or bespoke claim analysis is performed by this delivery.", "boundary": "Public answers remain free. Payment provides automatic retrieval, version binding and a saved delivery. It does not upgrade evidence or disclose protected material.", "snapshot_sha256": "c72cca4025bb22a8a3972963e365de8028ead7725508364bf735ca44b7dd524b", "record_ids": [ "VXI-EXT-PROCUREMENT-ELASTIC-REDACT-LICENCE-01-v1" ] }, { "schema": "varexis-index-delivery/1", "catalog_version": "2026-10-16T14:13:51.913Z", "route_id": "agentic_reviewed_presidio_detection_coverage_not_complete_anonymization", "question": "Does a clean Presidio result prove a document contains no sensitive information?", "answer": "Presidio combines configurable recognizers and can use external detection models. Its maintainers explicitly warn that automated detection does not find all sensitive information. The selected recognizers, languages and input types need buyer validation; a clean result cannot alone establish complete anonymization or permission to disclose the document.", "basis": "A saved snapshot of the reviewed public route and source records. No fresh source review, independent experiment, deployment assessment or bespoke claim analysis is performed by this delivery.", "boundary": "Public answers remain free. Payment provides automatic retrieval, version binding and a saved delivery. It does not upgrade evidence or disclose protected material.", "snapshot_sha256": "659b7a37c6f26424c93dd4f7c0e23e514e600b3708ba387e1db766c88d739e7f", "record_ids": [ "VXI-EXT-PROCUREMENT-PRESIDIO-COVERAGE-01-v1" ] }, { "schema": "varexis-index-delivery/1", "catalog_version": "2026-10-16T14:13:51.913Z", "route_id": "agentic_reviewed_datadog_sensitive_scanner_redaction_location", "question": "Does Datadog sensitive-data scanning prove raw content never leaves our environment?", "answer": "Cloud scanning receives data in the Datadog backend before redaction. Scanning within the customer environment is a different deployment choice. The supported fields differ across logs, APM, RUM and events, and optional sampling reduces the scanned fraction. A masked interface alone does not establish pre-egress redaction or complete coverage.", "basis": "A saved snapshot of the reviewed public route and source records. No fresh source review, independent experiment, deployment assessment or bespoke claim analysis is performed by this delivery.", "boundary": "Public answers remain free. Payment provides automatic retrieval, version binding and a saved delivery. It does not upgrade evidence or disclose protected material.", "snapshot_sha256": "2aee5542d06148773ffe719783fb6c87774d7e8e27ee5007bceef5a685f20449", "record_ids": [ "VXI-EXT-PROCUREMENT-DATADOG-SCAN-LOCATION-01-v1" ] } ], "rights_review": { "reviewed_on": "2026-10-16", "scope": "This exact public compilation of VAREXIS-authored review prose, factual identifiers, source links, dates and hashes.", "included": "Existing public VAREXIS review records and their limitations; an attributed comparison using the same documented findings.", "excluded": "Upstream documentation bodies, source code, screenshots, logos, private operator templates and protected evidence.", "redistribution_boundary": "Source links and hashes identify upstream material; they do not grant rights to redistribute that material. This package includes no upstream document bodies or code. Existing VAREXIS service terms apply to the supplied compilation.", "terms_url": "https://varexis.tech/checkout-terms", "independent_testing": false }, "delivery_unit": { "kind": "one_published_route", "member_count": 5, "developer_query_units": 1, "research_query_units": 1, "extra_member_purchases": false, "automatic_refresh": false } }, "snapshot_sha256": "872e3a822b404e14fcc9cbc56e510a4edbaf8dcb0cbf9e3382c8a7f2908e8f4d" }