Public pages contain source data
Generated public pages are built from an explicit public field selection and aggregates. They do not join customer watchlists, private notes or approval decisions. Static files are hosted on Cloudflare, while dynamic application requests pass through the protected application origin.
Workspace access is checked on the server
Requests for private workspace information require an authenticated session and current membership. Database workspace controls provide a separate tenant boundary. State-changing browser requests use same-origin and CSRF checks. Public carrier identifiers are not a substitute for authorization to a workspace.
Account controls and team responsibility
Sessions use secure browser cookies, and password recovery uses expiring one-use links. Accounts can review active sign-ins and revoke other sessions. Owners should keep workspace membership aligned with the people who need access and avoid sharing passwords. Protect exported notes and evidence under your own information-handling process.
Operational separation and backups
The application and database run in separate containers with resource limits; the database is not published on a host port. Database backups are stored offsite in private object storage, and a restore was validated during initial setup. These measures describe implementation, not a contractual uptime or independent certification. Contact support with a specific concern without sending passwords or secret keys.