Security overview
Source-backed architectural controls and the publication gate for a formal security statement.
Architectural controls
The platform separates platform and tenant token issuers, resolves every tenant explicitly, encrypts database credentials under a platform key, validates schema integrity during provisioning, records entitlement changes on both sides and verifies Stripe webhooks before processing.
Formal statement before launch
Penetration-test scope, vulnerability handling, incident notification, RTO/RPO, certifications and the measured SLA are not supplied. Publish only after the operational evidence exists.