Tenant isolation. Every tenant-table query flows through one
forOrg(orgId) choke — cross-account reads are structurally impossible, not just a
policy someone could forget.
Parameterized SQL only. No query is built by string interpolation.
Auto-escaping rendering. Ingested and user-entered text renders through one
escaping layer — vendor and customer text can't execute as markup on this site.
CSRF, rate limits, generic auth errors. Every state-changing request carries
a CSRF token; authentication is rate-limited; failures never reveal whether an account exists.
Strict headers and a Host allowlist. Content-Security-Policy with no inline
scripts, a Referrer-Policy, HSTS at the edge, and requests to an unrecognized Host are rejected.
Secrets stay out of the database and the logs. They live in the platform's
secret store, injected at boot.
Append-only evidence. The fetch → observation → change-record chain
is never overwritten; an undo is a new, recorded event, not a deletion.
Backups verified daily against point-in-time recovery.
Export and delete. Any account can export its full data and request deletion;
a cancelled account keeps read-only audit access for 90 days before purge.
No rate guarantees. RateRoutine is a prompt to verify against the official
source, not a replacement for that verification — that boundary is a design choice, not a
disclaimer bolted on after the fact.