Your subscribers' data can't be seen by another Trafyx tenant. Not by admin mistake, not by SQL injection, not by application bug. Row-level security enforces it in Postgres itself.
Every user-facing table has RLS policies enforcing tenant_id match. If application code forgets a WHERE clause, Postgres returns an empty result. Data leaks between tenants are architecturally impossible.
Anon key access is default-deny for sensitive tables. Mutations happen through server-side API routes with a scoped service role that logs every action.
Every mutation across every module writes to audit_events with actor, tenant, target, before/after diff, and timestamp. Kept forever. Exportable.
TLS 1.3 for all connections. Postgres storage AES-256 at rest via Supabase. RADIUS shared secrets stored encrypted, decrypted per-query only.
Automated PITR-capable backups every 24 hours with 30-day retention. Restore to any point-in-time within the last 7 days on request.
Data Processing Agreement available on request. Right-to-be-forgotten flow for subscriber records. EU customers routed to eu-west-1.
Mira runs on Claude, but she doesn't get free rein. Every action goes through the same enforcement path as a human admin.
Mira returns a JSON action from a whitelisted enum. Server code interprets it. She cannot generate or execute SQL directly.
Autonomous actions only above 90% confidence. Anything lower escalates to a human. This threshold is configurable per action type.
Every Mira invocation is scoped to one tenant's data. Cross-tenant reasoning is architecturally prevented in the API layer.
Mira's actions live in the same audit log as human actions, tagged [MIRA]. Fully reviewable, fully reversible.
Anthropic's zero-retention policy applies. Your subscriber data never trains a model, never leaves the tenant scope.
Every destructive Mira function has a preview mode. See what she'd do before you let her do it. Dunning, for example, defaults to preview.
If you've discovered a security issue, please email security@trafyx.ai — do not open a public issue. We'll acknowledge within 24 hours and work with you on responsible disclosure.