Security built around operational responsibility.

Access is authenticated and role-aware. Customer users receive only the modules and tenant contexts assigned to them, with administrative controls for memberships and active sites.

Service traffic is protected in transit using HTTPS. Access to operational data is scoped by customer and user permissions, and sensitive configuration is kept out of public client code.

The service uses input validation, controlled administrative actions, audit-oriented records and recoverable operational workflows. Security controls are reviewed as the platform and customer requirements evolve.

Review the coordinated disclosure and safe-harbour policy before testing or reporting a concern. It contains the private reporting channel, permitted testing boundaries and supported-service information.

Customer assurance contacts and the technical, organisational and support information available for a deployment are maintained in the canonical security policy.