Data & privacy
Encryption & storage
Fact quotes and connector credentials are encrypted at rest, as is self-hosted raw episode text when object storage is enabled; everything moves over TLS, and every query is scoped to one workspace at the query layer rather than by convention.
Isolation
Workspace scoping is applied in the store layer, so a route that forgets it does not return another tenant's rows — it returns nothing. Access checks for sensitivity compose on top of that scope.
Keys
Connector credentials and fact quotes are encrypted with a key held outside the database; so is self-hosted raw episode text, when object storage is enabled.