Security you can verify

• Postgres row-level security sits beneath every request, so an unscoped query returns nothing rather than someone else's rows.
• An always-scoped repository layer above it, with a build guard that refuses unscoped data access.
• Every managed organization runs pooled, and those two boundaries are the isolation — there is no per-customer database.
• Negative test suites prove isolation at the application layer and again at the database layer, against real Postgres.

Evidence produced · Every access decision is attributable to a tenant, and cross-tenant reads fail in CI rather than in production.

• A fail-closed authorization engine with per-domain permissions, custom roles, and attribute policies — permissions are never trusted from a token.
• The request-path database role can read and write rows and nothing else: it cannot alter schema, drop tables, or reach another database.
• Workers, the audit sealer, and the security plane hold separately scoped roles, granted per table.
• Phishing-resistant passkeys, authenticator codes, login throttling, Argon2id password hashing, and screening against known-breached passwords without the password ever leaving the platform.
• Step-up re-authentication for sensitive operations, bound to the specific operation and usable once.

Evidence produced · Every privilege grant is declared in code and cross-checked against the live database roles by a CI probe that runs as the real role.

• Managed hosting is in Singapore for APAC residency; self-hosting keeps everything inside your own infrastructure.
• Erasure requests are processed asynchronously. They remove the person's profile, memberships, passkeys, identity-provider identifier and connected-app consents, strip the email address, IP address and free text from the request record, and end their live sessions. The tamper-evident audit log is kept unaltered, event records are kept for their retention period, and a request is refused while the person is the only active owner of an organization that is still active.
• Retention is enforced per record class, and the evidence store deliberately cannot be purged by the component that writes to it.
• TLS everywhere with automatically renewed certificates; stored authenticator, webhook-signing and single-sign-on secrets are encrypted in the database, and backups are encrypted before they leave the server.
• The platform's own outbound calls are restricted to a vetted allowlist, so data cannot flow somewhere unreviewed. Customer-supplied webhook and logout destinations are reached through a separate proxy that refuses every private, internal and cloud-metadata address.

Evidence produced · Deletion and retention actions are audited like any other, so a privacy request has a record that shows what happened and when.

• More than 400 distinct actions are registered, and every one must carry telemetry, a detection decision, an audit decision, and a control mapping — or an explicitly recorded exemption with a reason.
• That requirement is a CI guard, not a policy: code that skips it does not merge.
• Security-relevant actions are written to a hash-chained log that makes silent modification detectable, sealed by a dedicated append-only role.
• More than 55 distinct control identifiers are mapped across the platform's actions, drawn from a catalogue of more than 65.
• The audit log, with its hashes, is available on every plan; per-framework evidence export and the readiness dashboards are part of the Enterprise plan, so the evidence is yours rather than only ours.

Evidence produced · A continuously produced, tamper-evident record — not a reconstruction assembled in the weeks before a review.

• Images are built in CI and signed keyless, each carrying signed SLSA v1 build provenance (Build Level 2) and an SPDX SBOM. The server never builds — it verifies every signature and both attestations, and deploys the exact verified digests, aborting the whole deploy on any verification failure.
• Application containers have no direct route to the internet; every outbound call passes an egress proxy — a closed allowlist for the platform's own calls, and a dedicated proxy that refuses every private address for customer-supplied destinations.
• Services run non-root on a read-only filesystem with no-new-privileges and all Linux capabilities dropped. Datastores sit on internal-only networks.
• Branch protection applies to administrators. Every change is a reviewed pull request through required checks that no one — including the owner — can bypass.
• Every image is vulnerability-scanned before it is signed: a fixable critical or high finding blocks the signature unless a dated, reviewed waiver covers it.
• Layered supply-chain defence: blocking static analysis, dependency auditing, pinned build actions, and continuous scoring, because no single scanner is trusted alone.

Evidence produced · Every deployed artifact is digest-pinned, and its signature and attestations are verified at deploy time, and the deploy refuses rather than degrades.

• Behavioural detections over the event stream, each raised against the organization it belongs to.
• Runtime security monitoring on the host, watching what containers actually do rather than only what they were built from.
• A dead-man's-switch alerting design: the absence of a signal is itself alertable, so a broken pipeline cannot look like a quiet week.
• Documented incident response and service-degradation procedures, with restore paths rehearsed rather than assumed.
• Backups with a defined recovery path, and the backup component isolated from the plane it protects.

Evidence produced · Detections, alerts, and operator acknowledgements are part of the same audited record as everything else.

• Scheduled drills execute the scenarios that matter — containing a running agent, an autonomy response, a federated workload identity handshake — and each one is scored PASS, FAIL, GATED or UNPROVEN rather than left to a green tick.
• A declared-but-undriven scenario scores UNPROVEN by construction: a drill cannot quietly pass by skipping the part that would fail.
• Race scenarios run real concurrent actors against the live API and assert the invariant, not the absence of an error message.
• Findings become work: each one is a tracked defect, fixed in code rather than documented around.

Evidence produced · Dated run records with per-scenario verdicts, the evidence each leg produced, and the findings that came out of them.

• Every agent holds its own cryptographic identity and a risk profile that scales how much oversight it attracts. It is never a shared account wearing a human's badge.
• Authority is delegated from the human the agent acts for and can only ever tighten, never widen.
• A fail-closed gateway checks allowlist, delegation scope, and rate and budget caps on every single tool call.
• Sensitive actions park for real-time human approval — bound to the specific action and usable once.
• A separately permissioned kill switch severs an agent mid-session at the transport, without waiting for it to finish.
• Where the platform can act on its own, it must first earn that autonomy from its own record of human-approved decisions, and a reversal demotes it.

Evidence produced · Every agent action, approval, refusal, and reversal is recorded with the human accountable for it.