OmniSandbox Legal & Compliance Center

1.1 Commercial & Technical Evaluation Scope

OmniSandbox is provisioned by OmniSCADA for the express purpose of evaluating industrial SCADA edge telemetry, Sparkplug B MQTT payload structures, and client compatibility. Access to both the public demo broker and dedicated container instances is granted solely under a limited, revocable, non-exclusive, and non-transferable evaluation license. The sandbox environment is categorized as an uncertified staging platform and is provided on an "AS IS" and "AS AVAILABLE" basis with no guaranteed service level agreements (SLAs) or uptime warranties.

1.2 Acceptable Use Policy (AUP) & Abuse Prohibition

Evaluators agree to use the sandbox platform solely for benign protocol validation and telemetry benchmarking. The following activities constitute an immediate, material breach and trigger instantaneous container termination and permanent IP blocklisting:

• Execution of Denial of Service (DoS/DDoS), syn-flood, or volumetric packet stress tests against broker endpoints.
• Automated brute-forcing, credential stuffing, or port scanning targeting the host kernel or sibling container namespaces.
• Cryptocurrency mining, distributed computing payloads, or botnet command-and-control channeling.
• Publishing malicious payloads, exploits, or unauthenticated scripts designed to corrupt MQTT broker daemons or subscriber nodes.

1.4 Ephemeral Container Leases & Automated TTL Reclamation

Dedicated sandbox instances (Track 2) are issued on an ephemeral time-to-live (TTL) lease of 60 minutes. Evaluators may submit a single +15-minute lease extension during the final 15 minutes of the active session. Upon lease expiration or administrative eviction, the container is destroyed immediately via docker rm -f. The host network port (ports 20001–20020) and designated slot hostname (e.g., slot-XX.sandbox.omniscada.com) are immediately wiped and returned to the unallocated resource pool. OmniSCADA is not liable for loss of in-flight message state upon container teardown.

1.5 Intellectual Property & Proprietary Firmware

OmniSCADA retains all proprietary rights, trademarks, copyrighted architectures, and process mimic algorithms (including wastewater, tank farm, and subsea generator models). Evaluator retains 100% sole intellectual property rights over any proprietary edge firmware, custom payload schemas, and client applications transmitting data to the assigned sandbox endpoint.

1.6 Limitation of Liability & Indemnification

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL OMNISCADA OR ITS AFFILIATES BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING INDUSTRIAL PLANT SHUTDOWNS, LOST PRODUCTION BATCHES, EQUIPMENT FAILURE, ENVIRONMENTAL REMEDIATION COSTS, OR DATA LOSS RESULTING FROM THE USE OF OR INABILITY TO USE OMNISANDBOX. TOTAL AGGREGATE LIABILITY SHALL NOT EXCEED $100.00 USD.

1.7 Administrative Revocation & Governing Law

OmniSCADA operations engineering reserves the unilateral right to terminate any sandbox session, revoke credentials, or ban IP subnets without prior notice if anomalous resource exhaustion, CPU spinning, or malicious behavior is detected. These Terms shall be governed by and construed in accordance with the laws of Delaware, USA, without regard to conflict of law principles.

2.1 Data Controller & Governance Scope

OmniSCADA is the designated Data Controller responsible for evaluator data collected through the OmniSandbox provisioning portal. Inquiries regarding data protection, rectification, or compliance may be submitted to privacy@omniscada.com.

2.2 Evaluator Lead & Technical Telemetry Collected

When requesting a dedicated evaluation sandbox container, evaluators provide explicit business contact data:

2.4 Legal Basis for Data Processing (GDPR & CCPA)

Processing of evaluator contact information is executed under GDPR Article 6(1)(b) (performance of a contract or steps taken prior to entering into an agreement to provision the sandbox infrastructure) and GDPR Article 6(1)(f) (legitimate interest in protecting shared cloud infrastructure from malicious abuse, credential stuffing, and denial-of-service vectors).

2.5 Data Retention Schedule & Right to Erasure (Article 17)

Lead records are retained in an encrypted SQLite database on host infrastructure for enterprise sales engineering follow-up and compliance audit logging. Evaluators possess the unconditional right to request full erasure under GDPR Article 17 and the California Consumer Privacy Act (CCPA). Submit a deletion request with your business email to privacy@omniscada.com. All associated lead records and session metadata will be permanently purged within 14 business days.

2.6 Infrastructure Hosting & Non-Disclosure

OmniSandbox is hosted on dedicated single-tenant bare-metal compute infrastructure. We do not sell, trade, rent, or lease evaluator contact lists or telemetry data to any commercial marketing brokers or third-party syndicates.

3.1 Architectural Classification: Track 1 vs. Track 2

Evaluators must understand the distinct operational boundaries between Track 1 (Shared Public Demonstration Broker) and Track 2 (Isolated Dedicated Ephemeral Sandbox):

3.3 Technical Guarantee: Zero Payload Disk Retention

OmniSCADA engineers our ephemeral sandbox runtime to enforce a strict Zero Payload Retention Architecture:

3.4 Bandwidth & Throughput Throttling

Dedicated sandbox instances are constrained to a burst rate limit of 250 messages per second with a maximum single MQTT packet size limit of 1 Megabyte. Packets exceeding these limits will be rejected by the broker buffer with an immediate socket reset to preserve container stability.

3.5 Synthetic Process Mimic Generators

OmniSandbox includes automated background synthetic generators (e.g., wastewater treatment basin levels, centrifugal pump vibration spectra, generator bus frequencies). All telemetry values generated by these background engines are purely mathematical simulations and do not correspond to any physical operating utility.

4.1 Defense-in-Depth Linux cgroups v2 Isolation

To protect shared infrastructure from "noisy neighbor" interference and prevent denial-of-service attacks, each ephemeral broker is spawned within a hardened Alpine Linux container utilizing Linux cgroups v2 resource boundaries:

Furthermore, all Mosquitto processes execute strictly under an unprivileged non-root UID (UID 1883), eliminating root container escape vectors.

4.2 Cryptographic Network Security & Traefik v3

Network communication to OmniSandbox is encrypted via Traefik v3 edge reverse proxies enforcing TLS 1.3 encryption across all public and dedicated entrypoints:

• MQTTS (Port 8883): Enforces TLS 1.3 with modern cipher suites (ChaCha20-Poly1305, AES-256-GCM). Certificates are dynamically issued and renewed via Let's Encrypt ACME with automatic Server Name Indication (SNI) resolution.
• WSS (Port 443): Secure WebSockets terminated at the reverse proxy layer for browser-based SCADA dashboards and client test consoles.
• Dedicated TCP Fallback Ports (20001–20020): Direct TCP forwarding channels reserved for legacy industrial hardware unable to perform TLS SNI handshakes.

4.3 Edge Threat Mitigation & Dynamic Blocklists

The Go Ingestion Core maintains an in-memory threat repository (BlocksRepo) evaluated on every inbound connection. IP addresses exhibiting anomalous connection volume, CIDR ranges belonging to public proxy/VPN exit nodes, and disposable email domains are automatically intercepted and rejected with HTTP 403 Forbidden responses.