---
title: "Compliance — AI Crawler Index"
description: "Certifications held: none, and this page says so first. What is processed, what is logged, who the one subprocessor is, and which standard questionnaire answers already exist in public."
canonical: "https://www.pathwren.workers.dev/compliance"
url: "https://www.pathwren.workers.dev/compliance.md"
format: "markdown"
source: "the bytes of /compliance, in the build that wrote the page"
generator: "surfaces/ai-crawler-index/build.py"
generated: "2026-09-03T07:55:35+00:00"
license: "CC0-1.0"
---

# Compliance

> Certifications held: none, and this page says so first. What is processed, what is logged, who the one subprocessor is, and which standard questionnaire answers already exist in public.

**This project holds no certification of any kind, and this page is a factual description of what happens here — not a legal opinion, and not a claim of compliance with anything.** It exists because a security probe asked for it by name and got a 404, and
a 404 tells you nothing at all.

| Usually asked for | Here |
| --- | --- |
| SOC 2 Type I / II | **Not held.** No audit has ever been performed. What exists instead: the whole stack is static files behind a worker, described at [/security](https://www.pathwren.workers.dev/security). |
| ISO/IEC 27001 | **Not held.** There is no organisation to certify. |
| Penetration test report | **None.** No test has been commissioned. The attack surface is published instead: no origin server, no runtime, no database in a request path, no accounts, no forms. |
| Data processing agreement | **Cannot be signed.** There is no legal entity to be a party to one. What is processed is listed in [/privacy.json](https://www.pathwren.workers.dev/privacy.json). |
| Subprocessor list | Cloudflare, and nobody else — worker, static assets and the request-log database. |
| Vendor security questionnaire | **Not answered individually.** Every answer this project has is already on [/security](https://www.pathwren.workers.dev/security), [/trust](https://www.pathwren.workers.dev/trust) and [/privacy.html](https://www.pathwren.workers.dev/privacy.html), in public, for everyone. |
| Uptime SLA | **None.** Free-tier hosting, best effort, no guarantee. |
| Cyber insurance | **None.** |

## Personal data

What is processed, and nothing else: the request itself. Time, path, query string,
user-agent, referer, accept header, status, bytes served, and a salted SHA-256 hash of the
requesting address, truncated to 16 hex characters. **The raw address is never stored and never served.** The purpose is measuring who reaches this host; the aggregate
result is public at [/stats.json](https://www.pathwren.workers.dev/stats.json) and the raw rows sit behind a token
precisely because they carry other visitors' user-agents and address hashes. No automatic
deletion is configured today — [/privacy.html](https://www.pathwren.workers.dev/privacy.html) states that plainly
instead of implying a schedule that does not exist. There are no accounts, so there is no
profile to export or erase; requests for removal of a published client page are honoured, and
that is the one piece of this a person can ask to have taken down.

## Cookies and consent

None are set and none are read, by anything here. There is no consent banner because there
is nothing to consent to, no JavaScript on any page, no tag manager and no third-party
script. The pages work with scripting disabled entirely.

## Accessibility

Plain semantic HTML, one stylesheet, no scripts, no images that carry meaning, no colour-
only signals, and every page usable at any width and by a text browser. The machine-readable
copy of nearly every page is linked from it, which is also the most accessible form there is.
No formal audit (WCAG or otherwise) has been performed; see the first line of this page.

## Licensing and reuse

Everything here is CC0-1.0 — public domain, no attribution required, commercial use fine,
mirroring encouraged. If your compliance question is "may we use this in a product", the
answer is yes, without asking. [/legal](https://www.pathwren.workers.dev/legal) has the detail.

## Export, sanctions, age

Nothing is sold, no payment is taken, no account is created, no software is distributed
from this host under an export-controlled licence, and there is no age-gated content. The
packages on [/packages.html](https://www.pathwren.workers.dev/packages.html) are published to public registries
under their own licences.

## Where this question usually goes next

[/trust](https://www.pathwren.workers.dev/trust) — what can be verified from outside in three curl commands ·
[/security](https://www.pathwren.workers.dev/security) — the posture, and every probe path that is 404 on purpose ·
[/privacy.html](https://www.pathwren.workers.dev/privacy.html) — the log, in full ·
[/contact](https://www.pathwren.workers.dev/contact) — one email address and what it is for.

Asked for by `Mozilla/5.0 (compatible; apievangelist-security-probe/1.0)`
at 2026-09-01T11:59:36Z in the same second as `/trust` and `/security`.
All three now answer.

## Sitemap

- [Full sitemap (XML)](https://www.pathwren.workers.dev/sitemap.xml) — every page, with dates
- [Full sitemap (markdown)](https://www.pathwren.workers.dev/sitemap.md) — the same map, readable
- [llms.txt](https://www.pathwren.workers.dev/llms.txt) — the whole host in one text file
- [documents.json](https://www.pathwren.workers.dev/documents.json) — every document, with its ETag
- [A2A agents](https://www.pathwren.workers.dev/a2a.html)
- [About and method](https://www.pathwren.workers.dev/about.html)
- [API](https://www.pathwren.workers.dev/api.html)
- [Changelog](https://www.pathwren.workers.dev/changelog.html)
- [Compliance](https://www.pathwren.workers.dev/compliance)
- [Contact](https://www.pathwren.workers.dev/contact)
- [Impressum · Anbieterkennzeichnung](https://www.pathwren.workers.dev/impressum)
- [AI Crawler Index](https://www.pathwren.workers.dev/index.html)
- [No model runs here](https://www.pathwren.workers.dev/inference.html)
- [Legal](https://www.pathwren.workers.dev/legal)
- [MCP server](https://www.pathwren.workers.dev/mcp-doctor.html)
- [MCP server](https://www.pathwren.workers.dev/mcp-lint.html)
- [MCP server](https://www.pathwren.workers.dev/mcp-netcheck.html)
- [MCP server](https://www.pathwren.workers.dev/mcp-robots.html)
- [MCP transport: the GET and HEAD leg](https://www.pathwren.workers.dev/mcp-transport.html)
- [MCP server](https://www.pathwren.workers.dev/mcp-triage.html)
- [MCP server](https://www.pathwren.workers.dev/mcp.html)
- [Packages](https://www.pathwren.workers.dev/packages.html)
- [Pricing](https://www.pathwren.workers.dev/pricing)
- [Privacy](https://www.pathwren.workers.dev/privacy.html)
- [API reference](https://www.pathwren.workers.dev/reference)
- [Access, keys and sign-up](https://www.pathwren.workers.dev/register)
- [Security posture](https://www.pathwren.workers.dev/security.html)
- [Upstream status](https://www.pathwren.workers.dev/status.html)
- [Terms of use](https://www.pathwren.workers.dev/terms.html)
- [Trust](https://www.pathwren.workers.dev/trust)

## Machine copies of this page

- [HTML (canonical)](https://www.pathwren.workers.dev/compliance)
- [JSON](https://www.pathwren.workers.dev/compliance.json)
- [Markdown](https://www.pathwren.workers.dev/compliance.md) — this document

This document is a markdown rendering of [https://www.pathwren.workers.dev/compliance](https://www.pathwren.workers.dev/compliance), generated from that page's own bytes in the same build. The HTML page is canonical.