Reliability, security & trust
Show, don’t claim.
Most security pages list vendors and certifications. This one lists the checks that run on every change and every night. Anything we can’t prove with a number reads “Unavailable”, not zero.
The full test suite runs every night.
Every night the whole automated test suite runs again, along with a scan for personal data leaking into the product’s output. A red night opens an issue and alerts the team. Fixes are reviewed by a person before they ship.
A feature can’t ship without its tests.
Every feature flag must have an MCP tool reference, a docs entry, AND an e2e test — CI-locked via cross-dim-audit --check. A regression cannot ship.
The audit trail is tamper-evident.
Every owner / admin / system-admin action writes a chain-hashed audit row. Cross-tenant scope leaks are structurally prevented at the SQL layer and covered by tenant-isolation tests.
- Chain-hashed audit logYes
- Tenant-isolation testsRun on every code change
- PII-leakage scannerRuns nightly
- SSRF guard on every outbound fetchRFC1918 + link-local + cloud-metadata blocked
- Bulk-mutation two-phase confirmHMAC-bound, 60 s TTL
Compliance.
SOC 2 Type I audit in progress with an outside firm. No report has been issued yet. Controls in place today include encryption at rest, a tamper-evident audit log, tenant isolation tests, SSRF guards, and a secret vault.
- SOC 2Type I audit in progress
- Encryption at restPer-row, with per-tenant BYO-KMS read-side
- Encryption in transitTLS 1.2+ everywhere
- Customer data residencyUS (Postgres + S3 + Modal)
- SubprocessorsFull list →
- AccessibilityStatement →
Reliability.
The full automated test suite runs every night. A red night opens an issue and alerts the team; fixes are reviewed by a person before they ship.
- Realtime process-resilience guardTransient DB / network errors logged + recovered without dropping live calls
- Cross-replica safetyFOR UPDATE SKIP LOCKED on every multi-replica-sensitive cron
- Anthropic resilient clientAuto-failover on 429 / 5xx / credit_balance_too_low
- Recording consentHard-gated; start + stop chime; no override