✓JWT-based authentication; every service refuses to boot with a placeholder signing secret.
✓Passwords hashed with bcrypt — never stored or logged in plaintext.
✓Multi-tenant isolation enforced at the database-query layer in every service, not just the UI.
✓Payment webhook signatures verified (HMAC) and fail-closed on misconfiguration.
✓AI assistant runs on a locally-hosted model — no customer data reaches an external AI API.
✓Role-based access control on every mutating endpoint across the platform.
✓CORS restricted to known origins outside local development.
◐No automated CI/CD gate yet blocking a regression from shipping — actively being built.
◐No field-level encryption at rest yet for MFA secrets and DFIR evidence metadata — currently relies on infrastructure-level protections.
◐SOC event data is not yet durably persisted (in-memory, cleared on restart) — a database-backed store is planned.