Access controls
Role-based access, MFA, session control and related capabilities remain subject to technical verification and the deployed product scope.
Security, ownership and deployment
Access should follow responsibility. Data practices should be explainable.
Controls vary by product scope and deployment. We publish only verified capabilities and document environment-specific responsibilities during implementation.
Traceability
Audit and accountability capabilities are described only where technically verified for the relevant workflow and environment.
Backup, restore and export
Frequency, retention, restoration procedures, RPO, RTO and export arrangements must be agreed for the deployed environment. No blanket guarantee is made here.