Tenant separation
Every customer record is company-scoped. Database row-level security and controlled operations are tested against cross-company access.
Trust and security
Evidence is useful only when its boundaries are honest.
These are product controls implemented in the current build. They are not a certification, penetration-test report, or promise that every government portal is supported.
Private evidence
Uploads, exports, and evidence reports use private storage and expiring access. Public links are not used for customer tax documents.
Credential boundary
Government credentials, when required, belong only in encrypted secure setup. They are excluded from ordinary application data, logs, analytics, and support messages. MFA remains customer-controlled.
Human-reviewed AI
Document extraction produces cited proposals. A person accepts or corrects fields before they become filing evidence.
Fail-closed status
Only explicit accepted authority evidence can become verified. Stale, missing, unknown, received, rejected, and simulated evidence cannot appear green.
Lifecycle controls
Owners can export company data, revoke sessions and invitations, communicate incidents, and request deletion through a cooling-off process.