Status of this document
This document has not yet been reviewed by external legal counsel. It is published so that prospective design partners can see the intended terms in full.
Deliberately incomplete
Common claims such as a specific hosting city, a named encryption standard at rest, georedundancy, zero data retention or defined backup schedules are not stated, because they are not verified for this service.
- Access control
- The application is reachable only over encrypted HTTPS connections. Product areas require an authenticated session.
- Authentication
- Accounts are managed by the platform's authentication service. Sessions are held as bearer tokens and validated server-side on every protected call.
- Authorisation
- Permissions are enforced server-side. Client-side permission display is presentation only and is re-checked on the server before any action.
- Tenant separation
- Every work product, document version, finding and decision is bound to a workspace. Row-level security policies scope access to the workspace of the acting user.
- Maker–checker separation
- The person who prepared a work product cannot issue its review disposition. This is enforced server-side, not only in the interface.
- Encryption in transit
- All traffic between the browser, the application and the platform services uses TLS.
- Storage
- Uploaded documents are held in a private storage bucket with no public access. Original files are preserved unchanged.
- Logging and attribution
- Activity events record who performed which action on which object and when. Inspection runs, including failed runs, are preserved rather than deleted.
- Environment separation
- Preview and published deployments are separated at application level.
- Privacy management
- Processing of confidential material is procedurally excluded during the current phase, and this restriction is stated in the product itself.
Not evidenced today
Encryption at rest characteristics, backup schedules and restore testing, log retention periods, and formal security certification are not evidenced and are therefore not claimed.