Compliance statement

Cross-border data transfer

Applies to: Anti-DDoS Proxy (Outside Chinese Mainland).

Scenario 1: Anti-DDoS Proxy (Outside Chinese Mainland) routes your cloud-hosted business data to the region that you select or to the region where the service is deployed. This routing may transfer data across national borders.

Scenario 2: Anti-DDoS Proxy (Outside Chinese Mainland) uses an Anycast architecture and typically scrubs attack traffic near its source. During a network exception, the service may reroute traffic to preserve workload availability. This failover may transfer data across national borders.

Before you use Anti-DDoS Proxy (Outside Chinese Mainland), review and accept the following responsibilities:

• The service may transfer your cloud-hosted business data to your selected region or the service deployment region, which may result in cross-border data transfer.

• You confirm that you have full authority to manage the business data and accept responsibility for its transfer.

• You must ensure that each transfer complies with applicable laws. This includes implementing appropriate technical and organizational safeguards, obtaining explicit consent where required, completing required security assessments and regulatory filings, and excluding content whose transfer or disclosure is restricted or prohibited.

• You accept the legal consequences of breaching these representations and must indemnify Alibaba Cloud and its affiliates for resulting losses.

Centralized management and control

Applies to: Anti-DDoS Proxy (Chinese Mainland) and Anti-DDoS Proxy (Outside Chinese Mainland).

Anti-DDoS Proxy uses region-specific management platforms to collect logs. The Security Overview and Attack Analysis pages consolidate traffic metrics and attack intelligence for protected workloads. The charts and operational data that you see reflect the Anti-DDoS Proxy instances that you purchased in each region.

Cookie insertion

Applies to: Anti-DDoS Proxy (Chinese Mainland) and Anti-DDoS Proxy (Outside Chinese Mainland).

Anti-DDoS Proxy inserts cookies into Layer 7 website traffic in the following scenarios:

• Scenario 1: HTTP flood mitigation is enabled in the DDoS protection policy for a website domain.

  When HTTP flood mitigation is enabled, Anti-DDoS Proxy inserts a cookie into each client, such as a browser, to distinguish clients and build client-level traffic statistics. Subsequent HTTP requests include the cookie. Anti-DDoS Proxy analyzes the resulting telemetry for HTTP flood activity and initiates traffic scrubbing when an attack is detected.

• Scenario 2: The action of an HTTP flood mitigation rule is set to Challenge.

  When a rule uses the Challenge action, Anti-DDoS Proxy inserts a cookie into the HTTP request header to collect a browser fingerprint. The fingerprint includes the HTTP host field and browser dimensions. When traffic matches the rule, Anti-DDoS Proxy challenges the client and evaluates the fingerprint telemetry to identify anomalous clients and HTTP flood activity.