From 574e5d829c1a50fc3ad08b8df3ed4606cfac8dd3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bence=20H=C3=A9zs=C5=91?= <bence.hezso@gmail.com>
Date: Sun, 25 Oct 2026 07:47:13 +0100
Subject: [PATCH] end every executive summary with legal notices, mark the
 edition

---
 README.md                             |   4 +-
 cloudexit/assets/template/egress.html |  20 ++
 cloudexit/assets/template/index.html  |  17 ++
 cloudexit/report/base.py              |   8 +-
 cloudexit/report/cover.py             |   2 +-
 cloudexit/report/egress.py            |  12 +
 cloudexit/report/executive_summary.py |   3 +
 cloudexit/report/html_sections.py     |   4 +
 cloudexit/report/notices.py           | 120 ++++++++++
 cloudexit/report/sections.py          |   5 +
 cloudexit/report/wording.py           |  71 +++++-
 tests/report/test_basic_report.py     | 325 ++++++++++++++++++++++++--
 tests/support/report_terms.py         |  14 +-
 13 files changed, 573 insertions(+), 32 deletions(-)
 create mode 100644 cloudexit/report/notices.py

diff --git a/README.md b/README.md
index 45c787d..5d0f857 100644
--- a/README.md
+++ b/README.md
@@ -303,5 +303,7 @@ The public contract is the `cloudexit` command, `python -m cloudexit` and `cloud
 
 ## License
 
-cloudexit is licensed under the **GNU Affero General Public License v3 (AGPL-3.0)**.  
+© 2024–2026 EscapeCloud. cloudexit is licensed under the **GNU Affero General Public License v3 (AGPL-3.0)**.  
 See [LICENSE](./LICENSE) for details.
+
+EscapeCloud, cloudexit and the EscapeCloud logo are trademarks. The AGPL-3.0 licence does not grant any right to use them; modified versions must not use them in a way that suggests they are official.
diff --git a/cloudexit/assets/template/egress.html b/cloudexit/assets/template/egress.html
index b8c3249..3243c38 100644
--- a/cloudexit/assets/template/egress.html
+++ b/cloudexit/assets/template/egress.html
@@ -431,6 +431,26 @@ <h3>Data Landscape</h3>
         </div>
       </div>
 
+      <div class="px-3 px-md-4 pb-4">
+        <div class="bg-white shadow-s rounded-4 p-4 mt-3">
+          <h2 class="h4 mb-3">{{ notices.heading }}</h2>
+          {% for block in notices.blocks %}
+          <h3 class="h6 mt-3">{{ block.heading }}</h3>
+          {% for paragraph in block.paragraphs %}
+          <p>
+            {% for part in paragraph %}{% if part is string %}{{ part }}{% else %}<a
+              href="{{ part[1] }}"
+              target="_blank"
+              rel="noopener noreferrer"
+              >{{ part[0] }}</a
+            >{% endif %}{% endfor %}
+          </p>
+          {% endfor %}
+          {% endfor %}
+          <p class="text-muted small mt-4 mb-0">{{ notices.copyright }}</p>
+        </div>
+      </div>
+
       <script>
         document.addEventListener("DOMContentLoaded", function () {
           document.querySelectorAll(".risk-row").forEach((row) => {
diff --git a/cloudexit/assets/template/index.html b/cloudexit/assets/template/index.html
index b88ddef..2c787c1 100644
--- a/cloudexit/assets/template/index.html
+++ b/cloudexit/assets/template/index.html
@@ -1103,6 +1103,23 @@ <h3 class="h6">{{ summary.closing.how_heading }}</h3>
           </p>
           {% endif %}
         </div>
+        <div class="bg-white shadow-s rounded-4 p-4 mt-3">
+          <h2 class="h4 mb-3">{{ summary.notices.heading }}</h2>
+          {% for block in summary.notices.blocks %}
+          <h3 class="h6 mt-3">{{ block.heading }}</h3>
+          {% for paragraph in block.paragraphs %}
+          <p>
+            {% for part in paragraph %}{% if part is string %}{{ part }}{% else %}<a
+              href="{{ part[1] }}"
+              target="_blank"
+              rel="noopener noreferrer"
+              >{{ part[0] }}</a
+            >{% endif %}{% endfor %}
+          </p>
+          {% endfor %}
+          {% endfor %}
+          <p class="text-muted small mt-4 mb-0">{{ summary.notices.copyright }}</p>
+        </div>
       </div>
       {% endif %}
     </main>
diff --git a/cloudexit/report/base.py b/cloudexit/report/base.py
index d8c5d9a..a7ad1c9 100644
--- a/cloudexit/report/base.py
+++ b/cloudexit/report/base.py
@@ -143,12 +143,10 @@ def draw_footer(canvas, running):
     canvas.setFont(FONT_MONO, 6.8)
     canvas.drawString(MARGIN, FOOTER_BASELINE, running.document_id)
 
-    classification = running.b["cover_classification_value"].upper()
-    classification_width = canvas.stringWidth(classification, FONT, 6.8)
+    edition = running.b["footer_edition"].upper()
+    edition_width = canvas.stringWidth(edition, FONT, 6.8)
     canvas.setFont(FONT, 6.8)
-    canvas.drawString(
-        (width - classification_width) / 2, FOOTER_BASELINE, classification
-    )
+    canvas.drawString((width - edition_width) / 2, FOOTER_BASELINE, edition)
     canvas.restoreState()
 
 
diff --git a/cloudexit/report/cover.py b/cloudexit/report/cover.py
index b7d069e..4af84e6 100644
--- a/cloudexit/report/cover.py
+++ b/cloudexit/report/cover.py
@@ -105,7 +105,7 @@ def _rows(self, context, b):
         )
         left = [
             CoverCell(b["cover_doc_id"], self.document_id, MONO_VALUE_STYLE),
-            CoverCell(b["cover_classification"], b["cover_classification_value"]),
+            CoverCell(b["cover_edition"], b["cover_edition_value"]),
             CoverCell(
                 b["cover_exit_strategy"], strategy_name(context.strategy_code, b)
             ),
diff --git a/cloudexit/report/egress.py b/cloudexit/report/egress.py
index 122b117..36bd1ca 100644
--- a/cloudexit/report/egress.py
+++ b/cloudexit/report/egress.py
@@ -37,6 +37,7 @@
 from cloudexit.providers.aws.egress import ARCHIVE_TIERS as AWS_ARCHIVE_TIERS
 from cloudexit.providers.azure.egress import ARCHIVE_TIERS as AZURE_ARCHIVE_TIERS
 from cloudexit.report.context import scope_facts
+from cloudexit.report.notices import notices_html
 from cloudexit.report.wording import BLOCKS
 
 PDF_HEADER_TITLE = "EscapeCloud Community Edition - Data & Egress"
@@ -582,6 +583,14 @@ def _load_estimate(
     return meta, rows, totals, pricing, total_fee, type_groups
 
 
+def _generated_at(timestamp):
+    # The run's own time, as the estimate stored it; now when it cannot be read
+    try:
+        return datetime.strptime(str(timestamp), "%Y-%m-%d %H:%M:%S UTC")
+    except ValueError:
+        return datetime.now()
+
+
 def generate_egress_html_report(report_path: str, json_path: str) -> dict[str, Any]:
     try:
         meta, rows, totals, pricing, total_fee, type_groups = _load_estimate(
@@ -625,6 +634,9 @@ def generate_egress_html_report(report_path: str, json_path: str) -> dict[str, A
             free_tier_limit_display=summary["free_tier_limit"],
             known_data_display=format_bytes(totals["known_size_bytes"]),
             type_groups=type_groups,
+            notices=notices_html(
+                meta["cloud_service_provider"], _generated_at(meta["timestamp"])
+            ),
         )
 
         html_path = os.path.join(report_path, "egress.html")
diff --git a/cloudexit/report/executive_summary.py b/cloudexit/report/executive_summary.py
index 9e96415..eb1b4d5 100644
--- a/cloudexit/report/executive_summary.py
+++ b/cloudexit/report/executive_summary.py
@@ -10,6 +10,7 @@
 from .cover import RecordCover
 from .evidence import build_document_information_page
 from .flow import chapter_break
+from .notices import legal_notices
 from .sections import (
     alternative_technologies,
     costs_overview,
@@ -45,6 +46,8 @@ def build_content(context, styles, b):
     content += glossary(context, styles, b)
     content.append(chapter_break())
     content += full_assessment(context, styles, b)
+    content.append(chapter_break())
+    content += legal_notices(context, styles, b)
     return content
 
 
diff --git a/cloudexit/report/html_sections.py b/cloudexit/report/html_sections.py
index 045572e..14127b5 100644
--- a/cloudexit/report/html_sections.py
+++ b/cloudexit/report/html_sections.py
@@ -2,6 +2,7 @@
 
 from .brief_summary import collect_brief_facts, finding_rows, lead_text
 from .helpers import severity_label
+from .notices import notices_html
 from .palette import SEVERITIES
 from .sections import glossary_entries, scope_boundary, scope_strategy
 from .wording import BLOCKS
@@ -118,4 +119,7 @@ def html_sections(context, b=BLOCKS):
             "url": provenance.platform_url,
             "assessment_id": provenance.assessment_id,
         },
+        "notices": notices_html(
+            context.cloud_service_provider, provenance.generated_at, b
+        ),
     }
diff --git a/cloudexit/report/notices.py b/cloudexit/report/notices.py
new file mode 100644
index 0000000..e404996
--- /dev/null
+++ b/cloudexit/report/notices.py
@@ -0,0 +1,120 @@
+import re
+from xml.sax.saxutils import escape
+
+from reportlab.lib.styles import ParagraphStyle
+from reportlab.platypus import Paragraph, Spacer
+
+from .evidence import link_markup
+from .fonts import FONT_BOLD
+from .sections import (
+    AWS_ICONS_URL,
+    AWS_TRADEMARK_URL,
+    AZURE_ICONS_URL,
+    LICENCE_URL,
+    REPOSITORY_URL,
+)
+from .wording import BLOCKS
+
+NOTICE_BODY = "NoticeBody"
+NOTICE_LABEL = "NoticeLabel"
+FIELD = re.compile(r"({[a-z_]+})")
+
+
+def _parts(template, links, values=None):
+    # A template split into plain text and (text, url) links, so the PDF and
+    # the HTML are built from the same content
+    parts = []
+    for piece in FIELD.split(template):
+        field = piece[1:-1]
+        if field in links:
+            parts.append((links[field], links[field]))
+        elif values and field in values:
+            parts.append(str(values[field]))
+        elif piece:
+            parts.append(piece)
+    return parts
+
+
+def _icon_notice(provider, b):
+    if provider == 2:
+        return _parts(
+            b["notices_icons_aws"],
+            {"icons_url": AWS_ICONS_URL, "guidelines_url": AWS_TRADEMARK_URL},
+        )
+    if provider == 1:
+        return _parts(b["notices_icons_azure"], {"icons_url": AZURE_ICONS_URL})
+    return None
+
+
+def notices_html(provider, generated_at, b=BLOCKS):
+    # The notices as plain data. A paragraph is a list of text and
+    # (text, url) links. Only the notice for the report's own provider's icons.
+    trademarks = [[b["notices_trademark_own"]], [b["notices_trademark_others"]]]
+    icons = _icon_notice(provider, b)
+    if icons:
+        trademarks.append(icons)
+    return {
+        "heading": b["notices_heading"],
+        "blocks": [
+            {
+                "heading": b["notices_disclaimer_heading"],
+                "paragraphs": [
+                    [b["notices_disclaimer"]],
+                    [b["notices_generated"]],
+                    [b["notices_purpose"]],
+                    [b["notices_figures"]],
+                ],
+            },
+            {"heading": b["notices_trademarks_heading"], "paragraphs": trademarks},
+            {
+                "heading": b["notices_software_heading"],
+                "paragraphs": [
+                    _parts(
+                        b["notices_software"],
+                        {"repository_url": REPOSITORY_URL, "licence_url": LICENCE_URL},
+                    )
+                ],
+            },
+        ],
+        "copyright": b["notices_copyright"].format(year=generated_at.year),
+    }
+
+
+def _markup(parts, color):
+    return "".join(
+        link_markup(part[1], color) if isinstance(part, tuple) else escape(part)
+        for part in parts
+    )
+
+
+def _styles(styles):
+    body = styles["ContentStyle"]
+    return (
+        ParagraphStyle(NOTICE_BODY, parent=body, fontSize=8.5, leading=12.5),
+        ParagraphStyle(
+            NOTICE_LABEL,
+            parent=body,
+            fontName=FONT_BOLD,
+            fontSize=9,
+            leading=13,
+            spaceBefore=8,
+            spaceAfter=2,
+            textColor=styles["Heading2"].textColor,
+        ),
+    )
+
+
+def legal_notices(context, styles, b):
+    notices = notices_html(
+        context.cloud_service_provider, context.provenance.generated_at, b
+    )
+    color = context.appearance.heading2_color
+    body, label = _styles(styles)
+    content = [Paragraph(notices["heading"], styles["Heading1"])]
+    for block in notices["blocks"]:
+        content.append(Paragraph(escape(block["heading"]), label))
+        for parts in block["paragraphs"]:
+            content.append(Paragraph(_markup(parts, color), body))
+    content.append(Spacer(1, 10))
+    content.append(Paragraph(escape(notices["copyright"]), body))
+    return content
diff --git a/cloudexit/report/sections.py b/cloudexit/report/sections.py
index 084593b..8e5e7e8 100644
--- a/cloudexit/report/sections.py
+++ b/cloudexit/report/sections.py
@@ -66,6 +66,11 @@
     ("escapecloud", "https://escapecloud.io"),
     ("exitcloud", "https://exitcloud.io"),
 )
+AWS_ICONS_URL = "https://aws.amazon.com/architecture/icons/"
+AWS_TRADEMARK_URL = "https://aws.amazon.com/trademark-guidelines/"
+AZURE_ICONS_URL = "https://learn.microsoft.com/en-us/azure/architecture/icons/"
+REPOSITORY_URL = "https://github.com/escapecloud/cloudexit/"
+LICENCE_URL = "https://github.com/escapecloud/cloudexit/blob/main/LICENSE"
 
 
 def _text(value, style=ALT_BODY):
diff --git a/cloudexit/report/wording.py b/cloudexit/report/wording.py
index d2ad9de..7e95447 100644
--- a/cloudexit/report/wording.py
+++ b/cloudexit/report/wording.py
@@ -42,14 +42,15 @@
     ),
     "cover_title_executive_summary": "Executive Summary",
     "cover_doc_id": "Document ID",
-    "cover_classification": "Classification",
-    "cover_classification_value": "Confidential",
+    "cover_edition": "Edition",
+    "cover_edition_value": "Community",
     "cover_exit_strategy": "Exit Strategy",
     "cover_run": "Assessment Run",
     "cover_run_value": "{run} · data as of {completed}",
     "cover_generated": "Generated",
     "cover_collected_with": "Collected by cloudexit {version} on {date}",
     "footer_page_of": "Page {page} of {total}",
+    "footer_edition": "Community Edition",
     "strategy_name_repatriation": "Repatriation to On-Premises",
     "strategy_name_hybrid_cloud": "Hybrid Cloud Adoption",
     "strategy_name_alternate_cloud": "Migration to Alternate Cloud",
@@ -368,6 +369,64 @@
     ),
     "fa_uploaded_link": "Open the reports: {link}",
     "fa_uploaded_id": "Assessment ID: {assessment_id}",
+    "notices_heading": "Legal Notices",
+    "notices_disclaimer_heading": "Disclaimer",
+    "notices_disclaimer": (
+        "EscapeCloud Community Edition - This report is provided 'As Is,' "
+        "without any warranty of any kind. EscapeCloud makes no warranty that "
+        "the information contained in this report is complete or error-free."
+    ),
+    "notices_generated": (
+        "This report was generated by cloudexit from data collected with the "
+        "organisation's own credentials. Its content was not reviewed or "
+        "verified by EscapeCloud."
+    ),
+    "notices_purpose": (
+        "It is provided for information and planning purposes. It is not "
+        "legal, financial or investment advice, an audit or an exit plan, and "
+        "it does not replace independent technical validation. The "
+        "organisation remains responsible for its own exit planning."
+    ),
+    "notices_figures": (
+        "Costs are taken from the provider's billing data for the scope. "
+        "Results reflect the data of the run shown on page 2 and may change as "
+        "the environment changes. Alternatives are entries from the data "
+        "catalogue, not recommendations."
+    ),
+    "notices_trademarks_heading": "Trademarks",
+    "notices_trademark_own": (
+        "EscapeCloud, cloudexit and the EscapeCloud logo are trademarks. The "
+        "AGPL-3.0 licence does not grant any right to use them; modified "
+        "versions must not use them in a way that suggests they are official."
+    ),
+    "notices_trademark_others": (
+        "Other product and company names in this report, including those of "
+        "alternative technologies, are trademarks of their respective owners. "
+        "Naming them does not imply endorsement or affiliation."
+    ),
+    "notices_icons_aws": (
+        "AWS service icons are taken from the AWS Architecture Icons "
+        "({icons_url}); their use is subject to the terms published there and "
+        "in the AWS Trademark Guidelines ({guidelines_url}). Amazon Web "
+        "Services and AWS are trademarks of Amazon.com, Inc. or its "
+        "affiliates. This report is not endorsed by or affiliated with Amazon "
+        "Web Services."
+    ),
+    "notices_icons_azure": (
+        "Azure service icons are taken from the Azure Architecture Icons "
+        "({icons_url}); their use is subject to Microsoft's icon terms "
+        "published there. Microsoft and Azure are trademarks of the Microsoft "
+        "group of companies. This report is not endorsed by or affiliated with "
+        "Microsoft."
+    ),
+    "notices_software_heading": "Software",
+    "notices_software": (
+        "cloudexit is free software, licensed under the GNU Affero General "
+        "Public License v3.0 (AGPL-3.0). Source code: {repository_url}. "
+        "Licence: {licence_url}. The provider icons are not covered by this "
+        "licence."
+    ),
+    "notices_copyright": "© 2024–{year} EscapeCloud",
 }
 
 # Labels and headings that follow English Title Case, for the wording test.
@@ -386,7 +445,13 @@
     "ev_platform_label",
     "cover_title_executive_summary",
     "cover_doc_id",
-    "cover_classification",
+    "cover_edition",
+    "cover_edition_value",
+    "footer_edition",
+    "notices_heading",
+    "notices_disclaimer_heading",
+    "notices_trademarks_heading",
+    "notices_software_heading",
     "cover_exit_strategy",
     "cover_run",
     "es_heading_introduction",
diff --git a/tests/report/test_basic_report.py b/tests/report/test_basic_report.py
index 7835898..a1aea40 100644
--- a/tests/report/test_basic_report.py
+++ b/tests/report/test_basic_report.py
@@ -7,6 +7,7 @@
 from datetime import datetime, timezone
 from html.parser import HTMLParser
 from pathlib import Path
+from unittest.mock import patch
 
 from pypdf import PdfReader
 
@@ -14,6 +15,8 @@
 from cloudexit.report import fonts
 from cloudexit.report.context import Provenance
 from cloudexit.report.executive_summary import generate_executive_summary
+from cloudexit.report.egress import generate_egress_html_report
+from cloudexit.report.notices import notices_html
 from cloudexit.report.palette import (
     DEFAULT_APPEARANCE,
     Appearance,
@@ -21,7 +24,16 @@
     contrast_pairs,
     contrast_ratio,
 )
+from cloudexit.report.sections import (
+    AWS_ICONS_URL,
+    AWS_TRADEMARK_URL,
+    AZURE_ICONS_URL,
+    LICENCE_URL,
+    REPOSITORY_URL,
+)
 from cloudexit.report.wording import BLOCKS, TITLE_CASE_KEYS
+from tests.report import test_egress as egress_helpers
+from tests.report.test_no_credentials import pricing_for_both_clouds
 from tests.support.flow import build_flow_run
 from tests.support.report import (
     build_empty_report_fixture,
@@ -39,6 +51,12 @@
 from cloudexit.version import __version__
 
 URL = "https://platform.test/assessments/a-1"
+AWS_NOTICE_LINKS = {
+    AWS_ICONS_URL,
+    AWS_TRADEMARK_URL,
+    REPOSITORY_URL,
+    LICENCE_URL,
+}
 COLLECTED = datetime(2026, 5, 7, 12, 0, tzinfo=timezone.utc)
 BASE_OUTLINE = [
     (0, "Brief Summary"),
@@ -58,8 +76,12 @@
 OFFLINE_OUTLINE = BASE_OUTLINE + [
     (0, "What the Full Assessment Adds"),
     (1, "How to Get Them"),
+    (0, "Legal Notices"),
+]
+UPLOADED_OUTLINE = BASE_OUTLINE + [
+    (0, "The Full Assessment"),
+    (0, "Legal Notices"),
 ]
-UPLOADED_OUTLINE = BASE_OUTLINE + [(0, "The Full Assessment")]
 SCORE_PATTERNS = (
     r"/ 100",
     r"/ 5\b",
@@ -288,7 +310,7 @@ def test_each_chapter_starts_a_page_and_page_two_is_the_document_information(sel
         numbers = [reader.get_destination_page_number(entry) for entry in chapters]
         # One chapter per page, except the severity levels and the glossary
         self.assertEqual(len(set(numbers)), len(numbers) - 1)
-        self.assertEqual(numbers[-3], numbers[-2])
+        self.assertEqual(numbers[-4], numbers[-3])
 
     def test_running_header_and_footer(self):
         path, context, reader = self.render(key="default")
@@ -297,7 +319,8 @@ def test_running_header_and_footer(self):
         for index, text in enumerate(pages[1:], start=2):
             self.assertIn("Smoke Test Assessment", text)
             self.assertIn(context.document_id, text)
-            self.assertIn("CONFIDENTIAL", text)
+            self.assertIn("COMMUNITY EDITION", text)
+            self.assertNotIn("CONFIDENTIAL", text)
             self.assertIn(f"Page {index} of {len(pages)}", text)
 
     def test_the_fonts_are_plex_and_nothing_else(self):
@@ -439,9 +462,10 @@ def test_an_offline_report_says_it_is_self_collected(self):
         self.assertIn(SYNC_ID, second)
         self.assertIn("2026-11-02 · (sha256 cccccccccccc)", second)
         self.assertIn("Self-collected data: no platform evaluated this report.", second)
-        self.assertIn("What the Full Assessment Adds", pages[-1])
+        self.assertIn("What the Full Assessment Adds", pages[-2])
         self.assertEqual(
-            link_targets(reader), {"https://escapecloud.io", "https://exitcloud.io"}
+            link_targets(reader) - AWS_NOTICE_LINKS,
+            {"https://escapecloud.io", "https://exitcloud.io"},
         )
 
     def test_an_uploaded_report_carries_the_link_instead_of_the_promotion(self):
@@ -451,10 +475,10 @@ def test_an_uploaded_report_carries_the_link_instead_of_the_promotion(self):
         self.assertIn("Uploaded to the platform", pages[1])
         self.assertIn(URL, pages[1])
         self.assertNotIn("Self-collected data", " ".join(pages))
-        self.assertIn("The Full Assessment", pages[-1])
-        self.assertIn(URL, pages[-1])
+        self.assertIn("The Full Assessment", pages[-2])
+        self.assertIn(URL, pages[-2])
         self.assertNotIn("What the Full Assessment Adds", " ".join(pages))
-        self.assertEqual(link_targets(reader), {URL})
+        self.assertEqual(link_targets(reader) - AWS_NOTICE_LINKS, {URL})
 
     def test_an_upload_without_a_link_names_the_assessment(self):
         _path, _context, reader = self.render(
@@ -464,7 +488,7 @@ def test_an_upload_without_a_link_names_the_assessment(self):
                 else provenance(uploaded=True, platform_url=None, assessment_id="a-77")
             )
         )
-        self.assertIn("Assessment ID: a-77", page_texts(reader)[-1])
+        self.assertIn("Assessment ID: a-77", page_texts(reader)[-2])
 
     def test_an_unknown_catalogue_version_is_said_so(self):
         _path, _context, reader = self.render(
@@ -563,14 +587,14 @@ def test_no_score_or_grade_appears_outside_the_closing_page(self):
         for name, fixture, overrides in self.scenarios():
             with self.subTest(name):
                 _path, _context, reader = self.render(fixture, key=name, **overrides)
-                body = " ".join(page_texts(reader)[:-1])
+                body = " ".join(page_texts(reader)[:-2])
 
                 for pattern in SCORE_PATTERNS:
                     self.assertIsNone(re.search(pattern, body, re.IGNORECASE), pattern)
 
     def test_the_closing_page_only_names_what_the_full_assessment_adds(self):
         _path, _context, reader = self.render(key="offline", provenance=provenance())
-        closing = page_texts(reader)[-1]
+        closing = page_texts(reader)[-2]
 
         for name in (
             "Exit Readiness Grade",
@@ -637,6 +661,7 @@ def test_the_html_follows_the_same_sections(self):
             "Risk Severity Levels",
             "Glossary",
             "What the Full Assessment Adds",
+            "Legal Notices",
         ):
             position = text.index(heading, position)
 
@@ -675,24 +700,288 @@ def test_the_guard_finds_what_it_should(self):
             find_terms("A DORA review of the supervisory rules"),
             ["DORA", "supervisor", "supervisory"],
         )
-        self.assertEqual(
-            find_terms("EscapeCloud Community Edition"), ["Community Edition"]
-        )
+        # The edition is this product's own, so it is not a foreign brand
+        self.assertEqual(find_terms("EscapeCloud Community Edition"), [])
         self.assertEqual(
             find_terms("Generated with exitcloud.io"), ["Generated with exitcloud.io"]
         )
         self.assertEqual(find_terms("an ordinary sentence about cloud exit"), [])
         self.assertEqual(find_terms("ICTs and DORAs"), [])
 
-    def test_the_platforms_are_named_only_on_the_closing_page(self):
+    def test_the_platforms_are_named_only_on_the_last_two_pages(self):
         _path, _context, reader = self.render(key="default")
         pages = page_texts(reader)
 
-        for text in pages[:-1]:
+        for text in pages[:-2]:
             self.assertNotIn("escapecloud", text.lower())
             self.assertNotIn("exitcloud", text.lower())
-        self.assertIn("https://escapecloud.io", pages[-1])
-        self.assertIn("https://exitcloud.io", pages[-1])
+        # The closing page keeps both platform URLs; the notices name EscapeCloud
+        self.assertIn("https://escapecloud.io", pages[-2])
+        self.assertIn("https://exitcloud.io", pages[-2])
+        self.assertIn("EscapeCloud", pages[-1])
+        self.assertNotIn("exitcloud", pages[-1].lower())
+
+
+class LegalNoticesTests(BasicReportTestCase):
+    ICON_MARKERS = {1: "Microsoft group", 2: "Amazon.com"}
+
+    def notices_page(self, key, fixture=None, **overrides):
+        _path, context, reader = self.render(fixture, key=key, **overrides)
+        return context, reader, page_texts(reader)
+
+    def test_the_last_page_is_the_legal_notices_in_every_scenario(self):
+        for name, fixture, overrides in self.scenarios():
+            with self.subTest(name):
+                context, reader, pages = self.notices_page(name, fixture, **overrides)
+                last = pages[-1]
+
+                self.assertIn("Legal Notices", last)
+                self.assertNotIn("Legal Notices", pages[-2])
+                self.assertIn(BLOCKS["notices_disclaimer"], last)
+                self.assertIn("© 2024–2026 EscapeCloud", last)
+                self.assertIn(REPOSITORY_URL, last)
+                self.assertIn(LICENCE_URL, last)
+                self.assertIn(BLOCKS["notices_trademark_own"], last)
+                self.assertIn(BLOCKS["notices_trademark_others"], last)
+                self.assertIn(BLOCKS["notices_purpose"], last)
+                self.assertIn("GNU Affero General Public License v3.0", last)
+                self.assertTrue({REPOSITORY_URL, LICENCE_URL} <= link_targets(reader))
+
+    def test_only_the_icon_notice_of_the_reports_provider_is_printed(self):
+        for name, fixture, overrides in self.scenarios():
+            with self.subTest(name):
+                context, _reader, pages = self.notices_page(name, fixture, **overrides)
+                provider = context.cloud_service_provider
+                other = 1 if provider == 2 else 2
+
+                self.assertIn(self.ICON_MARKERS[provider], pages[-1])
+                everything = " ".join(pages)
+                self.assertNotIn(self.ICON_MARKERS[other], everything)
+
+    def test_the_icon_links_follow_the_provider(self):
+        for name, fixture, overrides in self.scenarios():
+            with self.subTest(name):
+                context, reader, _pages = self.notices_page(name, fixture, **overrides)
+                links = link_targets(reader)
+                if context.cloud_service_provider == 2:
+                    self.assertTrue({AWS_ICONS_URL, AWS_TRADEMARK_URL} <= links)
+                    self.assertNotIn(AZURE_ICONS_URL, links)
+                else:
+                    self.assertIn(AZURE_ICONS_URL, links)
+                    self.assertNotIn(AWS_ICONS_URL, links)
+
+    def test_the_cover_names_the_edition_and_no_classification(self):
+        _context, _reader, pages = self.notices_page("offline", provenance=provenance())
+        cover = pages[0]
+
+        self.assertIn("EDITION Community", cover)
+        self.assertNotIn("CLASSIFICATION", cover)
+        self.assertNotIn("Confidential", cover)
+        self.assertNotIn("CONFIDENTIAL", " ".join(pages))
+
+    def test_every_running_footer_names_the_edition(self):
+        _context, _reader, pages = self.notices_page("offline", provenance=provenance())
+
+        for text in pages[1:]:
+            self.assertIn("COMMUNITY EDITION", text)
+            self.assertNotIn("CONFIDENTIAL", text)
+
+    def test_the_copyright_year_is_the_year_of_generation(self):
+        later = datetime(2027, 3, 1, 9, 0, tzinfo=timezone.utc)
+        _context, _reader, pages = self.notices_page(
+            "later", provenance=provenance(generated_at=later)
+        )
+
+        self.assertIn("© 2024–2027 EscapeCloud", pages[-1])
+        self.assertNotIn("2024–2026", pages[-1])
+
+    def test_the_notices_fit_one_page(self):
+        for name, fixture, overrides in self.scenarios():
+            with self.subTest(name):
+                _context, _reader, pages = self.notices_page(name, fixture, **overrides)
+                # Page n-1 is the closing page, n the notices; neither runs over
+                self.assertTrue(
+                    pages[-2].startswith("Executive Summary"), pages[-2][:60]
+                )
+                self.assertIn("Legal Notices", pages[-1][:200])
+
+    def test_no_placeholder_is_left_in_the_notices(self):
+        for name, fixture, overrides in self.scenarios():
+            with self.subTest(name):
+                _context, _reader, pages = self.notices_page(name, fixture, **overrides)
+                self.assertNotRegex(pages[-1], r"{[a-z_]+}")
+
+    def test_the_term_guard_passes_on_the_notices(self):
+        for name, fixture, overrides in self.scenarios():
+            with self.subTest(name):
+                _context, _reader, pages = self.notices_page(name, fixture, **overrides)
+                self.assertEqual(find_terms(pages[-1]), [])
+                self.assertEqual(american_hits(pages[-1]), [])
+                self.assertEqual(retired_term_hits(pages[-1]), [])
+
+
+class NoticesDataTests(unittest.TestCase):
+    def test_the_data_is_plain_and_ordered(self):
+        notices = notices_html(2, datetime(2026, 5, 7), BLOCKS)
+
+        self.assertEqual(notices["heading"], "Legal Notices")
+        self.assertEqual(
+            [block["heading"] for block in notices["blocks"]],
+            ["Disclaimer", "Trademarks", "Software"],
+        )
+        self.assertEqual(len(notices["blocks"][0]["paragraphs"]), 4)
+        self.assertEqual(len(notices["blocks"][1]["paragraphs"]), 3)
+        self.assertEqual(notices["copyright"], "© 2024–2026 EscapeCloud")
+
+    def test_links_are_text_and_url_pairs(self):
+        software = notices_html(1, datetime(2026, 1, 1), BLOCKS)["blocks"][2]
+        links = [part for part in software["paragraphs"][0] if isinstance(part, tuple)]
+
+        self.assertEqual(
+            links, [(REPOSITORY_URL, REPOSITORY_URL), (LICENCE_URL, LICENCE_URL)]
+        )
+
+    def test_each_provider_gets_its_own_icon_notice_and_an_unknown_one_none(self):
+        def trademarks(provider):
+            blocks = notices_html(provider, datetime(2026, 1, 1), BLOCKS)["blocks"]
+            return blocks[1]["paragraphs"]
+
+        self.assertIn("AWS service icons", "".join(map(str, trademarks(2)[2])))
+        self.assertIn("Azure service icons", "".join(map(str, trademarks(1)[2])))
+        self.assertEqual(len(trademarks(99)), 2)
+
+    def test_the_year_comes_from_the_generation_time(self):
+        for year in (2026, 2027, 2031):
+            notices = notices_html(2, datetime(year, 6, 1), BLOCKS)
+            self.assertEqual(notices["copyright"], f"© 2024–{year} EscapeCloud")
+
+
+class NoticesHtmlTests(BasicReportTestCase):
+    def index_text(self, provider, resources):
+        report = build_flow_run(
+            self.tmp / f"html-{provider}",
+            resources=resources,
+            costs=[("2026-09-01", 10.0, "USD")],
+        )
+        perform_risk_assessment(1, report)
+        details = (
+            {"region": "eu-central-1"} if provider == 2 else {"resourceGroupName": "rg"}
+        )
+        generate_report(
+            provider,
+            details,
+            1,
+            1,
+            "Flow",
+            report,
+            str(Path(report) / "raw_data"),
+            sync_id=SYNC_ID,
+        )
+        return html_text((Path(report) / "index.html").read_text(encoding="utf-8"))
+
+    def test_index_html_ends_with_the_notices_and_the_providers_icon_notice(self):
+        for provider, resources, own, other in (
+            (2, [(1, "eu-central-1", 3)], "Amazon.com", "Microsoft group"),
+            (1, [(3, "westeurope", 3)], "Microsoft group", "Amazon.com"),
+        ):
+            with self.subTest(provider=provider):
+                text = self.index_text(provider, resources)
+
+                self.assertGreater(
+                    text.index("Legal Notices"),
+                    text.index("What the Full Assessment Adds"),
+                )
+                tail = text[text.index("Legal Notices") :]
+                self.assertIn(BLOCKS["notices_disclaimer"], tail)
+                self.assertIn(own, tail)
+                self.assertNotIn(other, text)
+                self.assertIn(REPOSITORY_URL, tail)
+                self.assertRegex(tail.rstrip(), r"© 2024–\d{4} EscapeCloud$")
+                self.assertEqual(find_terms(text), [])
+
+    def test_the_links_in_index_html_are_real_links(self):
+        report = build_flow_run(
+            self.tmp / "html-links", resources=[(1, "eu-central-1", 3)], costs=[]
+        )
+        perform_risk_assessment(1, report)
+        generate_report(
+            2,
+            {"region": "eu-central-1"},
+            1,
+            1,
+            "Flow",
+            report,
+            str(Path(report) / "raw_data"),
+            sync_id=SYNC_ID,
+        )
+        html = (Path(report) / "index.html").read_text(encoding="utf-8")
+
+        for url in (REPOSITORY_URL, LICENCE_URL, AWS_ICONS_URL, AWS_TRADEMARK_URL):
+            self.assertIn(f'href="{url}"', html)
+
+    def egress_text(self, provider):
+        rows = [
+            egress_helpers._row(
+                "proddata", "Storage", "object", 2048 * egress_helpers.GIB
+            )
+        ]
+        payload = egress_helpers._payload(rows)
+        payload["meta"]["cloud_service_provider"] = provider
+        folder = self.report_dir()
+        json_path = folder / "egress_inventory_raw_data.json"
+        json_path.write_text(json.dumps(payload), encoding="utf-8")
+        egress_helpers._seed_egress_inventory(
+            str(folder), rows, egress_helpers._archive_tiers(rows)
+        )
+        with patch(
+            "cloudexit.report.egress.load_data", side_effect=pricing_for_both_clouds
+        ):
+            result = generate_egress_html_report(str(folder), str(json_path))
+        self.assertTrue(result["success"], result["logs"])
+        html = Path(result["html_path"]).read_text(encoding="utf-8")
+        return html, html_text(html)
+
+    def test_egress_html_ends_with_the_same_notices(self):
+        for provider, own, other in (
+            (1, "Microsoft group", "Amazon.com"),
+            (2, "Amazon.com", "Microsoft group"),
+        ):
+            with self.subTest(provider=provider):
+                html, text = self.egress_text(provider)
+                tail = text[text.index("Legal Notices") :]
+
+                self.assertIn(BLOCKS["notices_disclaimer"], tail)
+                self.assertIn(own, tail)
+                self.assertNotIn(other, text)
+                # The timestamp of the estimate gives the year
+                self.assertTrue(tail.rstrip().endswith("© 2024–2026 EscapeCloud"))
+                self.assertIn(f'href="{LICENCE_URL}"', html)
+                self.assertEqual(find_terms(text), [])
+
+
+class WordingGuardTests(unittest.TestCase):
+    def test_the_licence_name_is_a_proper_name_and_other_license_is_not(self):
+        self.assertEqual(
+            american_hits(BLOCKS["notices_software"]), [], BLOCKS["notices_software"]
+        )
+        self.assertTrue(american_hits("the license of the data"))
+        self.assertTrue(american_hits("Under this license, you may"))
+
+    def test_the_new_labels_are_in_the_title_case_list(self):
+        for key in (
+            "notices_heading",
+            "notices_disclaimer_heading",
+            "notices_trademarks_heading",
+            "notices_software_heading",
+            "cover_edition",
+            "cover_edition_value",
+            "footer_edition",
+        ):
+            self.assertIn(key, TITLE_CASE_KEYS)
+
+    def test_the_retired_classification_is_gone(self):
+        self.assertNotIn("cover_classification", BLOCKS)
+        self.assertNotIn("cover_classification_value", BLOCKS)
 
 
 class WordingTests(unittest.TestCase):
diff --git a/tests/support/report_terms.py b/tests/support/report_terms.py
index 6f356dc..1c73bea 100644
--- a/tests/support/report_terms.py
+++ b/tests/support/report_terms.py
@@ -47,10 +47,10 @@
     "2022/2554",
 )
 
-# Branding of other products' reports. The platforms are named once, on the
-# closing page, and that page is checked separately.
+# Branding of other products' reports. The platforms are named on the closing
+# page and the legal notices, which are checked separately. "Community
+# Edition" is this product's own edition and is no longer foreign.
 FOREIGN_BRANDS = (
-    "Community Edition",
     "Generated with exitcloud.io",
     "exitcloud.io document",
 )
@@ -87,7 +87,13 @@ def find_terms(text):
     re.IGNORECASE,
 )
 # Proper names and data from the provider may keep their own spelling.
-AMERICAN_ALLOWED = ("Resource Center", "Azure Monitor")
+AMERICAN_ALLOWED = (
+    "Resource Center",
+    "Azure Monitor",
+    "GNU Affero General Public License",
+    # The path of the licence file in the repository link
+    "blob/main/LICENSE",
+)
 
 # Words that stay lower case inside an English Title Case label.
 TITLE_SMALL_WORDS = {