# Data Processing and Network Egress

This document describes Zynor's technical data flows. It is not legal advice,
a data-processing agreement, or a claim that an application using Zynor is
automatically compliant with any privacy regime. The deploying organization
remains responsible for its lawful basis, notices, retention, contracts, and
regional requirements.

## Data handled

- DNS calls process hostnames, mail domains, record types, provider selection,
  response records, timing, and errors.
- Email validation processes the complete address in memory. Classification
  and persistent-cache keys are domain-level; result objects returned to the
  caller contain the normalized address.
- Optional deep validation may process domain/MX-derived URLs, response
  metadata, public IP addresses, and provider metadata.
- Debug logging redacts conventional email local parts and neutralizes control
  characters before invoking a consumer logger. Domains, providers, MX hosts,
  IP details, timings, and error text can remain visible. Logging is disabled
  by default, and a throwing consumer logger is isolated from validation.
- The library does not intentionally send the local part of an email address
  to DNS providers, IP-intelligence providers, or deep-validation HTTP hosts.

## Default egress

| Feature | Recipient/data | Default |
| --- | --- | --- |
| Platform/compatible DNS | Operating-system resolver on Node/Bun/Deno, or Cloudflare `node:dns` (backed by 1.1.1.1 DoH) on Workerd; queried hostname/type | Enabled on server and Workerd profiles |
| Google/Cloudflare/Quad9 | Selected public resolver; queried hostname/type and caller network metadata | Enabled according to runtime profile |
| Deep validation | Public endpoints derived from domain or MX hosts | Disabled |
| IP intelligence | Configured `ip-api`, IPWhois, or FindIP service; public IP/provider lookup | Disabled |
| Browser email intelligence | Core classification stays local; MX DNS and optional deep/IP requests follow the recipients above and originate from the visitor's browser | Core and MX-backed validation available; deep/IP paths are opt-in and browser-policy dependent |

DNS and HTTP providers independently receive network-layer metadata such as
source IP, time, and user agent/TLS characteristics. Their own terms and
privacy policies govern that processing. Bulk deployments must review provider
acceptable-use limits and should use an approved enterprise/self-hosted DNS
path rather than assume free public endpoints are a production SLA.

## Retention and storage

Server email validation uses best-effort plaintext JSON under the operating
system temporary directory by default. Domain/provider classifications
normally retain for 48 hours, no-MX results for 1 hour, and operational errors
for 5 minutes; IP/provider metadata can also be cached. Each versioned cache
namespace defaults to a maximum of 100,000 entries and 64 MiB. The cache is
not encrypted. Treat the host and configured cache directory as part of the
trust boundary.

`ValidationConfig.cache` provides the operator controls: set
`persistence: false` to prohibit every cache filesystem operation; set an
absolute non-root `directory` to move persistence; and lower `maxEntries` or
`maxFileBytes` to fit the deployment's retention budget. Invalid policy is
rejected before directory creation. These options apply per validator
instance; the entry-local static validator remains first-initialization-wins.

Cloudflare Workers and browsers use bounded memory-only email caches, with
10,000 entries per validator-owned namespace by default and no cross-isolate or
cross-page persistence. Browser DNS separately uses the resolver's bounded
in-memory cache. Zynor does not operate a central telemetry or hosted collection
service.

## Controller/operator checklist

Before production use:

1. select providers and regions that satisfy policy and contracts;
2. disable optional deep/IP intelligence unless explicitly approved;
3. configure queue/bulk limits within upstream acceptable-use and Worker
   request budgets;
4. decide whether plaintext caching is permissible; use
   `cache: { persistence: false }` for deterministic zero-disk retention or
   configure an approved absolute directory and lower resource bounds;
5. keep debug logging off or route redacted logs under an approved retention
   policy;
6. disclose third-party DNS/HTTP processing and retention in the application's
   own privacy materials where required;
7. support deletion/incident requests in the application layer; Zynor has no
   central service capable of fulfilling them.

See the README's Production Behavior section for exact endpoints and defaults,
[`docs/data-and-asset-provenance.md`](docs/data-and-asset-provenance.md) for
the current dataset integrity/origin record, and `SECURITY.md` for private
vulnerability reporting.