Security-First. Audit-Ready. Always Verifiable.

• An authenticator app (TOTP) or SMS, chosen per account.
• The authenticator secret is encrypted at rest; recovery codes are stored as password hashes, never in the clear.
• A used TOTP counter is recorded, so a code that has already been accepted cannot be replayed.
• Factors belong to the person, not the workspace — one enrollment covers every organization they belong to.

LimitBecause the factor is account-level, requiring it in your organization means that person uses a second factor at every login, including elsewhere.

• Access tokens are HS256-signed and valid for 8 hours.
• Refresh tokens last 30 days, rotate on every use, and are blacklisted after rotation and at logout.
• Revocation is checked when a token is used, so a logout takes effect immediately.

LimitThe 8-hour and 30-day lifetimes are fixed platform-wide. They are not configurable per organization today.

• Each failure is counted against the account and the lock is applied before the password is checked again.
• A successful login clears the counter and the lock.
• Last successful and last failed login are retained on the account.

• The production API default is authenticated access; a new endpoint is protected because of the default, not because someone remembered.
• Public endpoints are limited to marketing pages, health checks, and pre-account formation steps.
• Third-party callbacks are signed: the signature is mandatory, and each endpoint keeps its own idempotency receipt so a replayed event cannot fulfil twice.

• Every gate queries the access row for that person in that organization, and filters it to active seats.
• Removed people are deactivated rather than deleted, so an unfiltered check would be a privilege-escalation bug — the filter is part of the convention, not an option.
• Three buckets cover the platform: owner-only for billing and ownership, administrator for standard administration, governance-read for packets, decisions, and signatures.

• The response names the role the action needed, so the interface can explain the refusal instead of failing silently.
• The interface mirrors the same buckets for what it shows. It never decides access — the server does.

• Endpoints that take an organization id verify membership before reading anything.
• An organization supplied in a request header is verified the same way. A header is a claim, not an authorization.
• A wrong-organization lookup is indistinguishable from a missing one: it returns nothing rather than confirming the record exists.

LimitThis is row-level scoping in one logical database, not a separate database per customer. We would rather you know that than infer it from the word “isolation”.

• The suite carries tests written specifically for cross-organization reads, including through AI retrieval paths.
• An authorization fix ships with a regression test that fails without it — that test is what separates a defect from an opinion.

• AI features run on Google Cloud Vertex AI (Gemini) under enterprise terms, in United States regions.
• Those terms prohibit training on customer content. It is a contractual boundary, not a setting we toggle.

• Each organization has its own retrieval corpus. A query is scoped to your organization first.
• It is then filtered to what the person asking is cleared to see, before any content reaches the model.
• When a role cannot be resolved, the most restrictive clearance applies.

• Board context comes from a board, chair, or secretary seat — not from sitting on a governance committee.
• Guests and advisors receive no ambient organization context at all, in any AI surface.
• The same access contract governs the assistant, document chat, and memory recall, so a new surface cannot invent a looser rule.

• They are held outside the records the AI layer reads, so exclusion is structural rather than a filter that has to fire.

LimitWe are not end-to-end encrypted and do not claim to be. The platform must be able to read content in order to reason over it.

• No unencrypted transport, internal or external.
• Storage encryption is managed by the platform, including database and object storage.

• Credentials, API keys, integration tokens, and authenticator secrets are never in source control.
• A deploy fails when a newly required key is missing, rather than starting without it.

• The stored object is ciphertext, so a copy of file storage or its credentials alone does not reveal the file.
• Opening a file needs a fresh one-time code each time; every master-key use is recorded in Cloud audit logs.
• Confidential files are kept out of AI memory, previews, and share links.

LimitThe platform holds the master key so it can serve files to the people you name and support recovery. This is strong encryption at rest, not end-to-end encryption.

• It lives in its own field, separate from the rest of the application record, and is decrypted only to prepare the filing.
• A keyed hash lets the IRS one-responsible-party-per-day limit be counted without decrypting anyone’s identifier.
• Only the last four digits are ever displayed, and they are all that survives once the EIN is issued.

• Files that can be shared or imported are scanned before they leave the platform.
• The scanner is the only writer trusted to record a scan result. Retained governance documents reject ordinary saves that touch scan state, so a clean result cannot be forged through the application path.
• A password-protected PDF cannot be scanned, so it is refused with that reason instead of being passed through.

• 25 MB a file; archives capped at 5,000 entries and 100 MB expanded; images capped at 100 million pixels.
• Type is checked by content, not by the filename.
• Those caps exist for archive and decompression bombs, which arrive looking like ordinary documents.

• The watermark is applied to the rendition the link serves.
• Link access is recorded alongside the document’s other audit events.

LimitWatermarking applies to public share links, not to every download inside the platform.

• Secret scanning runs on every commit locally and again in CI, with a separate guard that blocks tracked environment files.
• Static analysis (Bandit) and dependency vulnerability scanning (pip-audit) run on every pull request.
• Code review is required before a change reaches production, and protected branches enforce the required checks.

• Hosted on Cloud Run with managed autoscaling and health-gated deploys; traffic shifts only after health is verified.
• Managed PostgreSQL with automated backups and point-in-time recovery.
• Revert to the last known-good release first; diagnose after the bleeding stops.

• We do not pursue legal action for good-faith research conducted under that policy.
• Affected customers are notified without undue delay, and within any deadline the applicable state breach-notification law sets.
• For material incidents we publish a post-incident summary.