Security is a product feature.

Every brand gets its own RAG index, storage prefix and row-level scope. Cross-brand reads are impossible by policy, not convention.

AES-GCM for third-party OAuth tokens with per-project keys. TLS 1.2+ for transport. Postgres at rest is encrypted by the managed provider.

Roles live in a dedicated table with a SECURITY DEFINER check. No client-trusted admin flag anywhere.

Every agent run, mutation and OAuth event lands in an append-only log with actor, IP and outcome.

Sev-1 target: 15-min ack, 4-hr customer comms, post-mortem within 5 business days.

Export as PDF, CSV and JSON in one click. Full delete pipeline in Privacy tab and via support.