Separate browser and server trust
Browser forms use public submission identifiers plus allowed origins. Server integrations use project- and environment-scoped bearer credentials that are submission-write-only.
Security boundaries
Implemented boundaries, stated precisely.
These controls are present in the current application build. They are product boundaries—not certifications, audit results, uptime promises, or security guarantees.
Keep every resource account-scoped
Every tenant-owned resource carries or derives an account identifier, and management queries enforce account ownership. PostgreSQL row-level-security hardening remains a deployment gate and is not claimed here as implemented.
Keep customer content out of telemetry
Logs use privacy-first route templates. Credentials, cookies, raw payloads, submitter data, and customer content are omitted by default.
Sign and constrain outbound webhooks
Production destinations require HTTPS. Delivery uses Standard Webhooks signatures, DNS and destination revalidation, pinned connections, bounded responses, retries, and explicit failed states.
Explicit exclusions
No unsupported compliance claim.
The planned acceptable-use boundary prohibits card or bank data, national identifiers, protected health information, children’s data, passwords, and secrets. Phase 1 does not claim HIPAA, PCI, or children’s-data compliance.