01Per-tenant encryption
AES-256 at rest. Per-tenant DEKs wrapped by a per-region KMS.
02RLS by default
Every public table ships with row-level security and explicit grants.
03Signed webhooks
All inbound webhooks verify HMAC-SHA256 with timing-safe equality.
04SSO ready
SAML 2.0 and OIDC for Studio Pro and Brand seats.
05No model training
Your patterns never train third-party models. Gateway calls are scoped & redacted.