# Takaful.Online Phase 18A pre-launch legal and local readiness

**Audit date:** 2026-08-26 (Asia/Kuala_Lumpur)
**Scope:** local pre-launch validation and legal/consent clarification. Production infrastructure was not tested because it has not been deployed.

## A. Revised readiness verdict

**READY WITH MANUAL PRODUCTION CHECKS.** The local Website configuration, public-routing contracts, legal-template architecture, quotation routing and required local regressions are ready for the next controlled deployment preparation. This is not “Ready for Controlled Launch”: production deployment, legal approval and Domain Health evidence do not yet exist.

## B. Frontend status

`takaful_online` has persisted frontend implementation status `ready`. It was verified only. The Website lifecycle had genuinely drifted to `live`; it was corrected through the Sites registry workflow to `draft` and recorded in the audit trail.

## C. Operator variants

| Variant | Global code | Website status | Global operator active | Routable after Website becomes Live |
| --- | --- | --- | --- | --- |
| `/aia` | `AIA` | Published | Yes | Yes |
| `/ge` | `GET` | Published | Yes | Yes |
| `/pru` | `PRU` | Published | Yes | Yes |
| `/et` | `ET` | Published | Yes | Yes |

Great Eastern remains global code `GET` with public slug `/ge`; `/get` is not created automatically. Etiqa `/et` is intentionally retained for platform testing.

## D. Production Domain Health

**PRODUCTION-ONLY CHECK.** `takaful.online` has not been deployed to production, so DNS resolution, expected target, HTTPS, certificate validity/expiry and served identity cannot be honestly validated from localhost. Automated Domain Health tests validate the local architecture, not production DNS/TLS.

## E. Privacy Policy review

The authoritative global template now identifies the quotation fields handled (including contact, personal profile, plans, selected operators and limited attribution where available), explains quotation, security and optional measurement purposes, and states that sharing is limited to certified agents associated with the operator(s) selected by the visitor. It explicitly excludes unrelated operators.

## F. Terms review

Terms now state that the Website facilitates an enquiry/quotation request, is not a Takaful contract or guaranteed quote/coverage, expects accurate information, and ties follow-up contact to the selected Takaful operator(s), subject to their underwriting and approval processes.

## G. Data Deletion review

The global page explains deletion/de-identification requests, identifying information needed to find a request and legitimate retention limits. No authoritative public privacy/data-deletion contact channel was found in the project, so no email or workflow was invented. **An approved public request channel is required before Live.**

## H. Quotation data-sharing semantics

The distribution contract is aligned with the legal wording: assignment records are created only for the Takaful operator IDs selected by the visitor. A new regression verifies that selecting two operators creates assignments for those two, never the unselected third operator. GET selection remains in GET/VastPro context without exposing that internal name in public legal copy.

## I. Quotation Form consent UI

Concise Malay disclosure was added above the submit action. It explains quotation-only use and selected-operator-agent sharing, with Website-relative links to `/privacy-policy` and `/terms`. No checkbox was added because the existing form has no consent-checkbox architecture and Phase 18A required no new legal UX mechanic.

## J. Global legal suitability

All three documents remain one global template per document type. They use only `{website_name}` and `{website_domain}`; therefore the same copy renders per Website without operator-specific hardcoding. Takaful.Online resolves to **Takaful.Online** and **takaful.online**. Sanitization continues to block scripts, event attributes and unsafe links.

## K. Manual business/legal sign-off

Before Live, obtain approval for:

- all three revised global legal templates;
- the selected-operator contact/sharing wording;
- an approved public privacy/data-deletion request channel;
- any retention, regulatory or operator-specific legal requirements outside the existing generic template.

## L. Optional marketing configuration

Logo, favicon, SEO metadata/OG image, Google Ads and trusted header-code settings remain optional and not configured for this Draft Website. One Campaign Popup is active and uses its storage-backed image. Social Proof is disabled. Google conversion implementation remains `value = 1` with no currency when configured.

## M. Production prerequisites

1. Deploy application and infrastructure while the Website remains Draft.
2. Configure DNS and TLS, including the expected infrastructure target.
3. Run Domain Health and verify DNS, HTTPS, SSL expiry and served identity.
4. Confirm production environment (`APP_ENV=production`, `APP_DEBUG=false`, `APP_URL`, proxies, cookies, queue workers, storage symlink and route/config cache).
5. Take database/storage backup and record a rollback revision.
6. Run controlled desktop/mobile, legal, quotation, attribution, popup and reporting smoke tests.
7. Only then consider Draft → Live.

## N. Audit events

- `website.lifecycle_changed`: corrected the detected `live` → `draft` inconsistency, with Phase 18A reason metadata.
- `global_legal.updated` ×3: privacy, terms and data-deletion templates refreshed through the global legal migration. Metadata contains document type/source only, not full HTML.

## O. Files changed in Phase 18A

- `app/Services/SitesWebsiteLegalContentService.php`
- `database/migrations/2026_08_26_000009_refresh_global_legal_templates_for_quotation_consent.php`
- `resources/js/Components/Sites/Public/SitesQuotationForm.vue`
- `tests/Feature/PremiumLeadApprovalGateEndToEndTest.php`
- `tests/Feature/SitesLegalPagesTest.php`
- `tests/Feature/SitesQuotationConsentUiTest.php`
- `docs/takaful-online-prelaunch-readiness.md`

## P. Verification

Run the focused Phase 18A legal, quotation, routing, domain-health, access/audit and pilot regressions, PHP lint, frontend build and `git diff --check` before sign-off. Build warnings about existing unrelated assets should be recorded separately if present.

## Q. Takaful.Online lifecycle

Confirmed **Draft**. No public Live change was made. Frontend implementation status remains **ready**.

## R. Phase 19 eligibility

Phase 19 may begin only as a controlled production deployment process after the manual legal and request-channel approvals above. Keep the Website Draft until production Domain Health and smoke tests pass. Phase 19 does not start automatically.