Security & privacy

• Same Supabase Auth identity as TAP / Neverhold
• Org seat_limit and membership enforcement
• Client portal separate from staff support portal
• No public SOC 2 / ISO / HIPAA claims; no published uptime SLA