Design controls, described plainly. Not a certification or a legal compliance statement.
Every tenant record carries a tenant ID and is protected by database-enforced row-level security under a restricted runtime role. The tenant comes from your authenticated membership, never from a browser-supplied ID or hostname alone. Composite foreign keys stop a record referencing another tenant's parent.
Individual accounts, role-based permissions, session revocation and an append-only audit trail. MFA is required for platform administrators. Support staff see your data only through a time-limited, read-only grant that you approve, with the operator's identity recorded.
Private, tenant-scoped storage paths; short-lived signed download links; uploads limited by type and size with content checks; downloads served as attachments so uploaded content never renders as application content.
Entitlements follow server-verified, signature-checked, replay-resistant payment events. Duplicate or out-of-order events cannot create a second transition.
Export is available on every plan. Retention, deletion, breach procedure and subprocessors are in the data processing and subprocessor pages.
Write to [email protected]. See also Trust & safety and Compliance.
Start with a real workspace. Build around your business.
