Security.

This page will be expanded ahead of public launch. In the meantime, our key practices are:

• Data hosted in the United Kingdom on Cloudflare and Supabase.
• All traffic over HTTPS with HSTS preload.
• Strict Content Security Policy on every page.
• Records and audit logs are append-only at the database level.
• Daily encrypted backups with documented restore steps.
• Independent error tracking and uptime monitoring.

For security disclosures, please email [email protected].