Any platform will tell you your data is secure and isolated. What follows is how, in terms specific enough that you could disagree with them — which is the only kind of claim worth reading on a page like this.
01
Isolation is structural, not a filter
A workspace’s records carry its identity in the data layer, and queries are scoped there rather than in each screen. The difference matters the day somebody writes a new report and forgets a where clause: with scoping in the query layer that report returns nothing extra, because there is nothing extra to return.
An audit command walks every table and every model and fails the build when one is not accounted for.
02
Your address is yours
Each workspace answers on its own hostname from the moment it is created, and session cookies are scoped to that host alone. A cookie written on one workspace cannot travel to another, which is what stops a shared browser from becoming a shared session.
Custom domains must prove ownership with a DNS record before they will resolve at all.
03
Closing an account is not losing it
A closed workspace enters a retention window rather than vanishing. During it the data can still be exported, and the name is never handed to anybody else — a former customer’s links should not start resolving to a stranger.
Export and billing stay reachable even while service is suspended, so a dispute never locks you out of the evidence.
04
Billing you can reconstruct
Usage is captured before it is priced, and every invoice line traces back to the day, the meter and the rate behind it. The ledger is double-entry and its trial balance is checked, so the books either balance or somebody is told they do not.
A day can be re-rated on its own if a rate was wrong, without rewriting the days around it.
05
The bill cannot punish you
There is no interest, no late fee and no charge for delay anywhere in the platform, and this is a constraint in the code rather than a policy in a document. An ageing report exists so somebody can telephone you; it has no column that prices the wait, and a test asserts that none of the words that would turn ageing into a charge ever appears in it.
An invoice ninety days overdue is driven in a test and asserted to be the same amount as on day one.
06
The exit, with its dates
These are the values the platform is running on right now, not an illustration. Every rung fires once per clock, and the clock only runs while a workspace has no access to the data — a module you are paying to keep reading has no purge date at all.
90days
held after access ends
60days
before purge, the first warning
7days
before purge, the export is delivered
A purge refuses to run at all until an export has been generated and delivered, with the person who authorised it recorded against it.