01
Tenant & matter isolation
Composite workspace/matter keys and relational constraints make cross-matter references unrepresentable. Ethical walls are membership, not hope.
Security
Confidentiality is architecture, not a policy PDF.
Matter isolation is enforced in the state machine and the database, credentials never enter the transition log, and every consequential crossing is auditable by construction.
02
BYOK without leakage
Customer keys are sent explicitly per request; no gateway-wide default key, no silent fallback to another account or disclosure destination.
03
Audit by construction
The transition log is the audit trail: every acceptance, quarantine, gap closure, and issuance with actor and support. Nothing else needs logging.
04
Originals are immutable
Create-once object keys, SHA-256 from actual bytes, derivatives with distinct lineage. Hash disagreement quarantines; it never quietly repairs.