Security & trust
The refusals are the product. Here is every one of them.
Data custody
Where it sits and who can read it
ResidencyChosen at org creation◆ immutable · asia-south1 (Mumbai)
Model keysEncrypted at rest, mode 600. No key, no storage — plaintext is never a fallback.
IndexingNothing is indexed off-box. Your source never leaves the builder you run.
TrainingCustomer data is never used to train any model. Not a setting — there is no path.
Personal data
One enforcement point, and it refuses
Every model call passes through one checkpoint. It scans the prompt and the retrieved context before any vendor sees it, and the refusal names the kind of thing, never the value.
government IDssalarytax amountsbank detailsphone numbersraw user notes
✗ model call refused · class: GOVERNMENT_ID
field: applicant.identifier value: [not recorded]
The executable gates
Run at stage 09. A failure stops the build — it does not log a warning nobody reads.
| Gate | Asserts | On failure |
|---|---|---|
| RLS-FORCED | Every tenant table has row-level security enabled and forced | halt |
| MIGRATIONS-ADDITIVE | Numbered contiguously, additive only, each with a stated rollback | halt |
| NO-VENDOR-IMPORT | No vendor SDK imported inside the core | halt |
| ONE-WRITER | Exactly one capability writes each table | halt |
| NO-CROSS-JOIN | No join across capability boundaries | halt |
| SERVER-PRICED | Money is an integer in the smallest unit, priced server-side | halt |
| ReuseLint | Every referenced type and method exists | halt |
| TEST-COUNTS | Counts reported, zero skipped — "we did not check" and "we checked" must not look alike | halt |
| SECRETS-ABSENT | No credential material in the generated tree | halt |
| AUDIT-COVERAGE | Every consequential mutation writes an audit event | halt |
| ERROR-TAXONOMY | Failures are typed, not strings | halt |
| RATE-LIMITS | Every public surface declares one | halt |
| DOC-DRIFT | A stated count matches its source | halt |
Certifications
SOC 2 Type II — in progressISO 27001 — in progressGDPRIndia DPDP
Two of these are in progress and are labelled as such. An audit that has not concluded is not a certification, whatever the logo on the slide says.
For your questionnaire
Documents behind a click-through NDA. Questionnaire answers are self-serve.