Security

Ethical Fail-Safe (EFS) Middleware

Every LLM response passes through the Ethical Fail-Safe before reaching the UI. No direct provider calls from the frontend. EFS scans for spoonfeeding, jailbreak, and PII leak patterns.

BLOCKED_BY_SAFEGUARD: Content replaced; soft flag logged. LOCKED_INTEGRITY: Enrollment locked; admin or appeal required to reverse.

Transport & Data Protection

All API traffic uses TLS 1.3. Credentials and evidence hashes use SHA-256 (legacy) and V3 uses SHA-3-512 for quantum-safe verification. Sensitive data at rest is protected with AES-256.

Database RLS (Row Level Security)

Enrollments, evidence, and outbox events are scoped by tenant. Row-level policies ensure that a tenant can only read/write their own data. Supabase (or equivalent) RLS is enforced at the database layer; the API does not bypass it.

Data Isolation for B2B Tenants

Each organization (tenant) has isolated data. Cross-tenant access is prohibited. ALF exports, risk heatmaps, and policy overlays are scoped to the authenticated tenant. JWT carries tenant_id; all queries filter by it.