diff --git a/README.md b/README.md
index bd5b008..850f60b 100644
--- a/README.md
+++ b/README.md
@@ -111,3 +111,18 @@ Copy `.env.example` to `.env` and set `HUBSPOT_PRIVATE_APP_ACCESS_TOKEN` to a Hu
 ## Deployment
 
 Deployed on **Vercel**. Pushing to `main` triggers a production deployment automatically. SPA routing is handled via `vercel.json`.
+
+### Demo-alias domain
+
+`fil.one` keeps landing on blocklists, and the `.one` TLD itself is flagged, which breaks live demos. The same deployment is therefore also served from **`filone.ai`** — an alias whose only value is an unflagged reputation. `fil.one` remains the canonical, public, indexed domain.
+
+`filone.ai` and `www.filone.ai` are attached to this Vercel project alongside the `fil.one` hostnames. The console is served on `app.filone.ai` from the same CloudFront distribution — see `PROD_CONSOLE_ALIAS_HOSTS` in `fil-one/fil-one`, `packages/shared/src/constants.ts`. DNS for the whole zone lives in `environments/prod/filone-ai.tf` in `fil-one/infrastructure`.
+
+**The alias must stay out of search results.** `vercel.json` sends `X-Robots-Tag: noindex, nofollow` for `(www.)?filone.ai` via a host-conditional `has` rule, placed first so it applies regardless of whether Vercel evaluates `headers` cumulatively or first-match. Canonicals need no special handling: `index.html` and `useSeo` already emit absolute `https://www.fil.one/…` URLs on every host, so the alias points search engines at the canonical domain by itself. **Do not** add a `Disallow` for the alias in `robots.txt` — that would stop crawlers fetching the page at all, so they would never see the `noindex` header, and the two mechanisms would cancel out. The `has.value` pattern is unanchored, so it also matches a host merely containing the alias; that only ever over-applies `noindex`, which is the safe direction.
+
+Keep the alias unadvertised: no public links, no marketing references, and do not add it to Search Console.
+
+Two things about `filone.ai` worth knowing before you change anything here:
+
+- It is also the domain every production Auth0 email is sent from, and a HubSpot campaign sender. Reputation damage earned by pages served here lands on the domain that delivers password resets, so treat a phishing report against the alias as a mail-deliverability incident too.
+- **`docs.fil.one` and `status.fil.one` links still leave the alias.** There is nothing to point them at — those subdomains do not exist on `filone.ai` — so on a network that blocks the `.one` TLD, clicking "docs" from an alias page fails. Known and accepted; fixing it means provisioning the subdomains on the docs Vercel project and Instatus.
diff --git a/vercel.json b/vercel.json
index 6ffc1b0..9ba9614 100644
--- a/vercel.json
+++ b/vercel.json
@@ -1,5 +1,14 @@
 {
   "headers": [
+    {
+      "source": "/(.*)",
+      "has": [
+        { "type": "host", "value": "(www\\.)?filone\\.ai" }
+      ],
+      "headers": [
+        { "key": "X-Robots-Tag", "value": "noindex, nofollow" }
+      ]
+    },
     {
       "source": "/assets/(.*)",
       "headers": [