Tenant isolation is architectural, not a setting.

Per-workspace database row-level security, per-workspace encryption context, per-workspace embedding namespaces, and strict mTLS between services. SOC 2 Type II attestation in progress; HIPAA-aligned; EU AI Act ready.

Highlights

• BYO keys with per-workspace envelope encryption on Business and above.
• Audit log streaming to SIEM (Splunk, Datadog, Sumo Logic) on Business and above.
• Sub-processor list published on the trust center with a 30-day change notice.
• Red-team engagements for prompt safety available on Enterprise.