Compliance checklist
Compliance checklist
This page repackages facts already published on other pages into one table. It is for a reviewer running a compliance pass who wants to skim rather than read four separate pages. No new claims are made here: every answer below is stated in full on the linked page. No certification (SOC 2, ISO 27001, or similar) exists for this product, and none is claimed on this page or any other.
| Requirement category | Our answer | Where verified |
|---|---|---|
| Where registration runs | On-device only. Matching and finding an anchor are a local computation, with no server call involved. | offline by design |
| What crosses devices | The anchor payload only: positions, normals, and scalar features, never camera images. Sending it anywhere is the caller’s own choice, not a built-in service. | offline by design |
| Cloud or service dependency | None, not as a tier and not as an architecture. Offline covers anchor creation as well as finding an anchor, not localization alone. | offline by design |
| Network capability in the native binary | None compiled in. The import table contains no networking DLL (no ws2_32, winhttp, or wininet), checkable with dumpbin /imports on the shipped win-x64 binary. | offline by design |
| Data processing agreement / sub-processor list | Not applicable to anchor data. The pipeline that matches anchors never sees a network. So there is no DPA to negotiate and no sub-processor to list for that data. | offline by design |
| Personal data we store (site and account) | Email address, IP address, and license/order records. No passwords are stored; sign-in is a one-time emailed link. | privacy policy |
| Personal data we never collect | No analytics or advertising cookies, no third-party tracking, no data broker or ad network anywhere in the pipeline. | privacy policy |
| Payment data | LansAnchor is currently trial-only. No payment is taken today, and we do not collect or store any payment or card details. | privacy policy |
| GDPR export | Self-service “Download my data” at /account exports every license, issuance-log entry, and suppression status as JSON, gated by a signed-in session. | privacy policy |
| GDPR delete | Self-service “Delete my account and data” at /account permanently deletes license records, issuance-log entries, and suppression status, and revokes active keys immediately. | privacy policy |
| Session and login handling | Sign-in is a one-time emailed magic link, not a stored password. | privacy policy |
| License check in shipped apps | None. Shipped apps ship with RequireLicenseIntent false: no runtime license check, no network call, nothing license-related embedded in the player build. | licensing |
| License token verification | Signed tokens verified fully offline. The only step that needs a network connection is requesting a trial key. | licensing |
| Match verification before a result is reported | Every match passes hard verification gates before it is ever reported as found: surface overlap, point-to-plane error, floor-height agreement, normal agreement, footprint coverage, bidirectional consistency, and a confidence check. | how it knows it’s right |
| Accuracy disclosure | Measured pass and fail rates are published, including confident-wrong cases, not only the adversarial-gauntlet number (the hardest test cases) that looks best. | how it knows it’s right |
Full detail lives on the source pages: offline by design, privacy policy, licensing, and how it knows it’s right.