# AZ2 — UK affiliate marketplace

> AZ2 connects shoppers with verified UK merchants, products, brands, and voucher codes. Zero tracking cookies, no personal data sale.

AZ2 is an affiliate marketplace (MPA) built by AKADATA LIMITED. Consumers browse products, compare prices, and click out to merchant sites to purchase. Commission is earned on confirmed sales — no data is sold or shared.

## Browsing and discovery

- [Home](https://www.az2.co.uk/home): Entry point with featured products and merchants
- [Categories](https://www.az2.co.uk/categories): Top-level category directory
- [Category page](https://www.az2.co.uk/category/{slug}): Products filtered by a specific category, paginated at `/category/{slug}/page/{n}`
- [Brands](https://www.az2.co.uk/brands): All brands with product counts
- [Brand page](https://www.az2.co.uk/brand/{slug}): Products for a specific brand
- [Merchants](https://www.az2.co.uk/merchants): All active merchants on AZ2
- [Merchant page](https://www.az2.co.uk/merchant/{slug}): Products and vouchers for a merchant, filterable by category at `/merchant/{slug}/category/{cat}`
- [Vouchers](https://www.az2.co.uk/vouchers): Live voucher codes and offers from merchants
- [Search](https://www.az2.co.uk/search): Full-text search across products, brands, and merchants

## Product pages

Each product has a dedicated page at `https://www.az2.co.uk/products/{merchant}/{category}/{product-name}-{ProductID}`
Pages include: product name, price, stock status, merchant info, description, related products, and JSON-LD structured data.
Variation groups (multiple colours/sizes) render at `/products/{merchant}/{category}/{family-name}` with colour and size selection.

## Information pages

- [About Us](https://www.az2.co.uk/about): Company background and mission
- [Contact](https://www.az2.co.uk/contact): Contact form for enquiries
- [Help Center](https://www.az2.co.uk/help): FAQ and support information
- [Account Recovery](https://www.az2.co.uk/account-recovery): Password and account recovery flow
- [Trust and Safety](https://www.az2.co.uk/trust): Platform trust, security, and privacy commitments

## Legal

- [Privacy Policy](https://www.az2.co.uk/privacy): Data handling and privacy practices
- [Cookie Policy](https://www.az2.co.uk/cookies): Cookie usage (disabled on AZ2)
- [Terms of Service](https://www.az2.co.uk/terms): Terms governing site use
- [GDPR](https://www.az2.co.uk/gdpr): GDPR compliance information
- [Licensing](https://www.az2.co.uk/licensing): Platform licensing details

## Security and architecture

AZ2 does not use HTTP cookies, PHP sessions, or third-party SaaS products. Account state is managed entirely via the AZ2 Identity Envelope (AIE) — an encrypted bearer token bound to the browser user-agent and Origin header.

### AIE (AZ2 Identity Envelope)

- Short-lived guest tokens are issued before login, registration, or contact submission
- Sensitive payloads (passwords, personal data) are encrypted browser-side using ECDH P-256 before submission, adding an application-layer encryption envelope on top of TLS
- Authenticated tokens carry signed claims (issuer, audience, subject, role, user-agent hash) inside an encrypted JWE wrapper
- Token validity is verified on every protected request: signature, time bounds, user-agent binding, Origin header match, and active server-side session row
- Session tokens are rotated on protected page transitions and revoked on logout — no cookies to clear, no ambient session
- One-time server-side challenge consumption prevents replay of encrypted submissions

### AIP-56 Human Recovery Key

Password reset and account recovery use the AIP-56 Human Recovery Key system:
- On registration, a random recovery phrase is generated and shown once to the user
- The phrase is one-way encrypted server-side before storage — AZ2 cannot read or recover it
- Recovery requires the exact phrase; no email-based reset flow bypasses it
- The phrase is never logged, cached, or transmitted in plaintext after initial display

### EB2 — The Conversational DRAGON

EB2 is the stateless conversational catalog interface. It runs over the same AIE transport:
- Chat messages stay in the browser unless the user submits an AZ2 action
- No conversation history is stored server-side between sessions
- EB2 queries the live catalog (products, merchants, vouchers) and returns structured results
- The chat panel is rendered server-side (SSR) — no JavaScript framework hydration

## Platform principles

- Zero cookies: No tracking, analytics, or session cookies are used
- No PHP sessions: All state is carried explicitly in the AIE bearer token
- No SaaS: Every component is self-hosted — no third-party analytics, CDNs, or tracking scripts
- No personal data sale: Commission is earned on confirmed sales, not from selling user data

## Optional

- [Platform statistics](https://www.az2.co.uk/platform-stats): Live traffic and outlink metrics (admin-only route, returns 404 for public)
- [https://www.az2.co.uk/llms.txt]: This file — site structure and documentation for LLMs