Security
Governed AI work needs visible controls.
ReRao presents tenant isolation, audit posture, public-site guardrails, and certification status with source-aware boundaries.
Evidence posture
Product proof surfaceTrust controls are shown by maturity.
Audit evidence, tenant isolation, access control, and certification work are presented as separate states.
Trust posture
Evidence control record
Input
Access policy
source data enters the workflow
Output
Audit evidence
reviewable state exits the workflow
Tenant isolation enforced
Source and state visibleSecurity that shows its work.
Security content separates implemented controls, audit status, and roadmap certification work.
Tenant isolation
Database-level row policies are the public proof point; implementation evidence is listed in source labels and reviewable artifacts.
Evidence bundles
Agent decisions, provenance, and human overrides are designed to be exportable for review and audit.
Access control
Enterprise identity is handled through organization-scoped authentication and role-aware API access with explicit boundaries.
Deployment control
Sovereign evaluation patterns are separated on the sovereign page for infrastructure review and deployment comparison.
Public motion stays editorial, sanitized, and first-party only.
These checks are the release-blocking posture for high-motion public pages before merge or deploy.
Design-partner preview only
Screenshots, reels, and animated cards use sanitized example content; no customer data, policyholder names, or production identifiers are displayed.
Privacy-safe telemetry
Public-site telemetry stays first-party and event-level only; it does not capture document contents, extracted fields, or form inputs.
Reduced-motion fallbacks
Motion surfaces degrade to static evidence cards when the browser requests reduced motion, so the proof remains readable and accessible.
First-party assets and scripts
The marketing site does not rely on third-party embeds or trackers, and its CSP constrains scripts, media, frames, and workers to approved origins only.
The public site should never imply customer access in production, hidden production workflows, or real policyholder data inside motion-led product proof.
Compliance and evidence claims.
Row-level isolation
Tenant access is enforced at the database boundary, not only in application filters.
alembic/versions/029_force_rls_policies.py
Audit evidence
Per-submission evidence bundles keep agent and human decisions reviewable.
audit evidence bundle migrations
SOC 2
Public copy must state audit status rather than certification completion.
company-provided status
ISO 27001
Information security certification remains roadmap until verified.
roadmap status only
Review security posture with ReRao.
Bring a real submission packet into a scoped design-partner evaluation for broker intake, placement handoffs, operations, or sovereign deployment.
Evaluation requested
Review-ready