Security posture, in plain words

• Authorization is policy-only

  Every screen, route and download goes through a policy. Anonymous access is an allowlist of named routes, and a test walks every other route to prove it refuses.

• The audit trail cannot be edited

  It lives in its own database schema. The application’s credentials can insert and read; the grant to update or delete does not exist.

• Nothing leaves the building

  No third-party scripts, no CDN, no outbound HTTP on behalf of user input. Search and the optional assistant run self-hosted; the public FAQ has a physically separate search index.

• Files are never served statically

  Every byte of a document or image streams through one policy-checked, audited route — no public disk, no pre-signed URL.

• Two-factor is mandatory where it matters

  Administrators and anyone who can provision accounts must hold a second factor. Passkeys are optional beside it. Invitations are signed, single-use and expiring; nobody sets another person’s password.

What is not done yet

• An independent security review — the brief for a reviewer is ready; the review has not happened.
• A screen-reader pass by a person; the automated gate covers the structural rules, not the experience.
• Passkeys verified on a real device on a real hostname.