Reports, questionnaires, and subprocessors with their real state. We list only what exists — no aspirational badges: today no audit report or certification is claimed, and the DPA and subprocessor list are provided on request.
Tenant isolation
Every request carries an authenticated organization, project, and environment. Authorization is enforced server-side on every route and object; the client never decides access. Credentials are encrypted per tenant and readable only by the gateway at dispatch time.
Content handling
Content retention defaults to zero. When an organization opts in, content becomes a separate permission and retention state — not a column toggle. Support access to content is time-bound, reason-coded, and audited.
Secrets
API keys are shown once and stored as hashes. Provider credentials use write-only inputs. No secret appears in URLs, logs, analytics, error tools, or support bundles — including for our own operators.
Continuity
Per-endpoint circuit breakers decided on gateway-measured evidence (transient provider failures trip them; a bad key never does). Provider failure degrades to re-routing inside your constraints, not to an outage. Incident communication is per component; no multi-region control plane is claimed.