Legal

Security

What we actually do today — not promises about features we have not shipped.

Phase 1 controls include CSRF, secure session cookies, Argon2 passwords, optional TOTP MFA, tenant isolation, private object storage design, CSP, and an append-only audit log. TLS terminates at Nginx in production. We do not claim certifications we have not earned.