Security and retention

Tenant isolation

Keep every query and mutation scoped to one workspace.

Workspace scope is resolved from the authenticated principal and membership. Foreign identifiers must fail closed without revealing whether a record exists in another workspace.

Data minimisation

Store redacted evidence rather than raw payloads by default.

• Collector-side redaction removes configured sensitive fields.
• Structural shapes and fingerprints support drift detection without raw values.
• Correlation uses hashes for business identifiers.
• Secret credentials and GitHub installation tokens are excluded from evidence views.

Retention

Apply the configured evidence retention policy.

Evidence retention must follow the workspace policy and operational requirements. Retention should remove expired evidence without weakening audit records required for decisions and delivery provenance.