Trust & Security

We verify it. We don't just say it.

We don't tell you your data is isolated — we run automated checks against live infrastructure on a schedule and show you the result. This page explains exactly what we check and renders our own current, live status below.

Live status

Verification Degraded

At least one check below is currently unverified or failing. We show that honestly here rather than paper over it.

How verification works

Every claim on this page traces to exactly one automated check the platform actually runs — never a hardcoded assertion. A check that has never run shows as unverified, not a false green. A check that's currently failing shows as failing, immediately — it does not get quietly upgraded because the rest of the system looks healthy.

Some facts below are labelled Documented rather than Verified — architecture-wide design facts (like which subprocessors we use) that don't yet have a live per-deployment check behind them. We label the difference so you always know which is a running check and which is a design statement.

What we check

The live catalog of automated checks backing this deployment's posture.

Cron job liveness

Verified 5m ago
SMS delete-on-delivery

Verified 5m ago
Call recordings: none at the carrier

Verified 5m ago
Artifact review answers reach jat

Failing 5m ago
AI inference never leaves our network

Every embedding and chat completion is probed to confirm it routes through our own on-network inference relay — there is no cloud fallback for it to fall back to.

Verified 6m ago
RLS policy matches the declared baseline

Every table's row-level security policies are diffed against our committed manifest — any drift between what's declared and what's live is caught immediately.

Verified 6m ago
Row-level security on every table

We continuously scan for any table missing its isolation policy — a gap here would silently let one tenant see another's rows.

Failing 5m ago
Isolation cannot be bypassed

Row-level security is FORCE-enabled everywhere it's required, so even a misconfigured query can't skip it.

Verified 5m ago
Audit trail actively recording

We verify the append-only audit log is still receiving new events, not silently stalled.

Verified 6m ago
Database schema kept current

Your schema is checked against the platform's applied migration ledger, so nothing silently drifts out of date.

Failing 6m ago

Also documented (not a live check)

Minimal subprocessor surface

Postgres, MinIO, and Better Auth run on the same infrastructure; Cloudflare is DNS-only — no request payload transits it.
Documented
Named subprocessors, no silent ones

Email (Resend), SMS (Twilio), and payments (Stripe) — named explicitly, none receive PHI.
Documented