Session protection
Signed-in routes require authenticated sessions with role-aware org membership.
Trust & compliance
Security
Access is enforced through authenticated sessions and organization-aware storage policies, not public-link sharing defaults.
PostgreSQL-backed authorization
Data persistence and visibility are enforced at the data layer to reduce UI-only security gaps.
You control model keys
API keys come from your env or account settings; example pages run locally without remote model calls.