Security and privacy

• Tenant isolation is enforced in every query by workspace id; permissions are evaluated server-side and deny by default.
• Passwords use Argon2id; secrets at rest are sealed with the server encryption key; invitation and attempt tokens are stored hashed.
• Rate limits and failure budgets protect sign-in, password and invitation guessing, uploads and AI calls.
• Uploads are sniffed, allow-listed, size-limited, optionally scanned with ClamAV and served through signed proxy links.
• Personal data in results is masked in exports and aggregates; small cohorts are suppressed; 360° feedback responses are never attributable to a rater.
• Account deletion queues a purge job; audit events are append-only.
• Backups are encrypted and verified; see the operations runbooks in the repository.