Client-side encryption, OIDC SSO, per-user isolation, full audit trails, approval workflows. The dedicated security page — with our SOC 2 roadmap and pen-test cadence — is in preparation.