Row-level tenant isolation
Separation is enforced by the database on every query, not by application code remembering to filter.
Security
Monitoring is consented, and isolation is in the database
This product captures screenshots and activity. That is a serious thing to run on somebody's machine, so the consent path and the isolation model are written down rather than implied.
What is in place
Each of these is a mechanism, not a policy statement.
Consent before capture
Where a monitoring policy is published, tracking is refused until the person on that machine has accepted it.
Multi-factor sign-in
Available per account, with step-up re-authentication on sensitive actions.
Append-only audit
Administrative actions are recorded in a log that cannot be edited after the fact.
Backup with a rehearsed restore
Nightly backups, and the restore is exercised on every deploy rather than assumed to work.
Evidence under legal hold
Captured evidence can be held so that retention sweeps cannot remove it while a matter is open.
What we have not built
There is no SAML or OIDC single sign-on, and no SCIM provisioning. If your procurement process requires either, we are not a fit today and we would rather say so on this page than in a security questionnaire three weeks in.
Backups are taken and restores are rehearsed, but off-box replication is not yet in place. That is a deliberate, recorded gap rather than an oversight.