Security
Tenant isolation, encryption, and independent verification are built into the platform, not bolted on.
Authentication
Every request is authenticated with a signed JWT (Ed25519). Tenant and user identity always come from verified token claims — request headers are never trusted for identity.
Tenant isolation
Every database query and vector search is scoped to your tenant. Cross-tenant data access is structurally impossible, not just policy-enforced.
Encryption at rest
Webhook secrets and repository credentials are encrypted (AES-256-GCM, per-secret derived keys) before they're ever written to storage. Nothing sensitive is stored in plaintext.
Verified before delivery
Generated code is never executed unverified. Every component runs through an independent oracle/QA verification ladder — including real test execution for your stack — before it reaches you.