Data Captured
- Device posture signals (OS version, patch level, EDR status) necessary to enforce zero-trust rules.
- Session metadata: tunnel start/stop time, assigned gateway, and service tags. Payload content is never inspected.
- Optional location hints derived from gateway selection for latency optimization; precise GPS is never collected.