Deflecto is operated under an ISO/IEC 27001 information security management system. We process traffic data only to provide the service, retain request logs for 30 days by default (configurable from 0 to 400 days), and offer EU-only processing. A data processing agreement, sub-processor list and penetration-test summary are available on request.