Defense in depth, by default.

A dedicated security page with the full posture lands before the first paid module. The architecture is already wired: Supabase auth, RLS-enforced multi-tenancy on every table, encrypted at rest and in transit, secrets in AWS Secrets Manager, and zero-trust service-to-service auth.

• ✦SOC 2 Type II — work starts this year, public report when ready.
• ✦Bug bounty program at GA. We pay fairly and answer fast.
• ✦Pen test summaries published annually with material findings.
• ✦Incident response runbook, on-call rotation, public status page.