Security in documents, not adjectives.

Objections are answered with a gate list. If a gate is missing, we do not claim it.

• Secrets stay out of client code

  Evidence: Gitleaks before deploy.

• Data access is server-side

  Evidence: No public keys in the browser.

• Auth on the server

  Evidence: You approve who can do what.

• Dependencies are scanned

  Evidence: CVE check before each change.

• Human code review

  Evidence: Independent programmer on every build.

• Approval gates

  Evidence: The system proposes. You click.

• Logging

  Evidence: Actions leave a trail.

• GDPR

  Evidence: DPA on request. EU hosting for intake.

• Backup and rollback

  Evidence: A change that fails can be reversed.

• Your repo, day one

  Evidence: Replaceable by design.

Your data is yours: export, clean exit, deletion. Data safety playbook.