Trust
Security and isolation
Claims here map to controls in the running product. We do not publish decorative certification theater.
Tenant isolation
Company data is scoped by company_id with row-level security. Cross-tenant reads and writes are denied.
Human authorization
Sealed decisions require a human signature on the same content before side effects run. Duplicate approve is blocked.
Legal and subprocessors
Privacy, DPA, cookies, and subprocessors are published on this host. Production secrets stay in the secrets manager — never in the client.