Data & privacy
Encryption & storage
Episodes are encrypted at rest, everything moves over TLS, and every query is scoped to one workspace at the query layer rather than by convention.
Isolation
Workspace scoping is applied in the store layer, so a route that forgets it does not return another tenant's rows — it returns nothing. Access checks for sensitivity compose on top of that scope.
Keys
Connector credentials and episode contents are encrypted with a key held outside the database. Rotating it re-wraps stored secrets without re-encrypting the episode corpus.