<?xml version="1.0" encoding="UTF-8"?>
<!-- Static sitemap: only deliberately-indexable public pages.
     Every URL here must return 200 (no redirect), be allowed by
     robots.txt, and carry a self-referencing canonical.
     The root / is intentionally NOT listed: it 301s to /login,
     which is the canonical public page.
     Must stay in sync with the Allow list in robots.txt and the
     per-page robots meta policy (login.php, changelog.php, legal.php).
     App, workspace, tenant, and token pages are intentionally absent. -->
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  <url>
    <loc>https://hrcluster.app/login</loc>
  </url>
  <url>
    <loc>https://hrcluster.app/changelog</loc>
  </url>
  <url>
    <loc>https://hrcluster.app/privacy</loc>
  </url>
  <url>
    <loc>https://hrcluster.app/security</loc>
  </url>
  <url>
    <loc>https://hrcluster.app/dpa</loc>
  </url>
  <url>
    <loc>https://hrcluster.app/subprocessors</loc>
  </url>
</urlset>
