# Canopy Data Readiness and Boundaries

This page documents the data boundary for business users reviewing the
`canopy-lang-site` static landing page and the public Canopy quickstart. It is
not a production data-processing agreement, privacy notice, support contract,
or provider integration plan.

## Quickstart Data

The landing-page quickstart uses synthetic data generated locally in the
example Python process. It does not use live market feeds, brokerage accounts,
customer portfolios, or external data-provider credentials.

The static site does not collect user-submitted data. It has no forms, login
flow, uploaded files, checkout, account area, hosted notebooks, or runtime API
for strategy inputs. Visitors can copy the quickstart and run it in their own
environment, where their local retention and security controls apply.

## External Data-Provider Responsibilities

External data-provider responsibilities remain with the buyer, operator, or
the selected provider. Before connecting Canopy package code to an external
provider, review:

- market-data license rights, redistribution limits, venue coverage, and
  allowed commercial use
- provider quality controls for splits, dividends, corrections, missing bars,
  delayed feeds, and survivorship bias
- provider uptime, rate limits, export rules, access controls, and audit logs
- provider retention, deletion, incident, and support commitments
- credential handling outside this static repository

The static site does not create a provider account, store provider
credentials, proxy provider traffic, or guarantee provider data quality.

## Canopy Language and Package Responsibilities

Canopy language and package responsibilities are limited to the code and
examples that parse strategies, run local backtests, and operate on data
provided by the caller. The package does not provide market data, does not
custody customer data, does not broker trades, and does not run a hosted data
service from this static site.

Package users are responsible for validating any external provider adapter,
input dataset, storage location, and execution environment before using Canopy
in a commercial workflow.

## Retention Boundaries

Retention boundaries are split by where the data is handled:

- Static site: no user-submitted strategy, portfolio, account, or provider data
  is submitted to this repository's static page.
- Quickstart example: synthetic data exists in the user's local Python process
  when they run the example.
- User environment: notebooks, logs, exported backtest results, caches, and
  provider data are retained according to the user's local systems.
- External provider: market-data retention, deletion, audit, and access-log
  behavior is controlled by the selected provider and contract.
- Repository: docs and examples must not include live customer data, provider
  credentials, private URLs, account identifiers, or trading account exports.

Any future hosted workflow, form collection, support portal, analytics change,
or provider integration needs a separate data-boundary review before it is
published.

## Logs and Analytics Status

The static site currently has no application backend and no user-submitted data
collection path. Hosting, CDN, browser, and provider access logs may still
record visit metadata under the controls of the hosting or analytics provider.

`index.html` includes the Vercel Web Analytics script reference that existed
before this page. Analytics ownership, retention expectations, dashboard
access, and commercial reporting commitments remain pending review in the
operations runbook. Do not add analytics identifiers, tracking pixels,
conversion events, customer segmentation, or retention promises until that
review is complete.

## Support Data Expectations

Support data expectations are intentionally narrow. For public issues,
commercial conversations, or support handoff, use synthetic data, reduced
examples, and non-sensitive error output.

Do not send customer portfolios, account numbers, provider credentials,
proprietary strategy code, trading histories, private URLs, or live export
files through public repository issues. Use the security reporting path for
vulnerability concerns and wait for an approved private channel before sharing
sensitive details.

Commercial support ownership, response expectations, and private intake paths
remain pending review.

## Unsupported Financial and Trading Claims

Canopy examples and backtests are for research workflows only.
They are not financial advice. They are not investment recommendations,
data-provider endorsements, trading-system approvals, or compliance
certifications.

Historical results, synthetic results, optimized parameters, or sample metrics
do not guarantee live performance, execution quality, profitability, data
quality, provider availability, or regulatory suitability. Business users
should perform their own legal, compliance, security, and data-provider review
before relying on Canopy in a commercial workflow.

## Related References

- [Operations runbook](operations.md)
- [Security reporting path](../SECURITY.md)
- [B2B readiness gap map](b2b-readiness-gap-map.md)