Security
Rule-based critical path, tenant isolation, France hosting.
France hosting
OVHcloud data, Scaleway fr-par compute. No service keys in the browser.
No cleartext PII
Agent action logs are designed without cleartext PII; IDs are hashed.
Hash chain
Append-only SHA-256 audit, verifiable in console or compliance pack.
Multi-tenant RLS
Every query is tenant-scoped; PostgreSQL RLS is the last line of defense.
Control plane
Deny / HITL / suspend at ingest. Egress proxy = Control plan (roadmap).