Two-step sign-in, invite-only teams

Email + password, plus TOTP authenticator MFA (any standard app) with one-time backup codes. Admins invite teammates by email; nobody but the invitee ever sets or sees their password.

Database-enforced tenant isolation

Every tenant-scoped query now runs under a restricted database role that can physically only see your tenant's rows — a second, independent wall underneath the application's own checks, not just a filter that could be misconfigured away.

Tamper-evident audit log

Logins, MFA events, admin actions and every security-relevant event are chained together — altering or deleting any past entry breaks the chain, and a one-click check confirms your team's history hasn't been touched.

Your history stays private

Session transcripts are encrypted in your browser before upload — the server only ever sees ciphertext. Search runs locally on your device, and deleting a session wipes its content for good.

Client-side, end-to-end encrypted recordings

Recording is one click, optional. Audio is encrypted in the browser (AES-256-GCM) before upload — the server only ever stores ciphertext, a SHA-256 integrity manifest and a wrapped content key. Playback re-verifies the hash, decrypts locally, and plays back with a duck-respecting mix, a scrubber, and one-click MP3 download.

3f9ae2·AES-256-GCM·b71cd0·SHA-256 ✓

Short-lived, single-purpose credentials

AI provider API keys never reach the browser. The server mints a scoped, short-lived client secret per session — and every budget or quota check is enforced atomically, server-side, before a paid session is ever minted.

Ephemeral Remote Speaker credentials

A remote presenter's login is temporary and single-use — never a real account, hashed rather than stored in the clear, rate-limited against guessing, and superseded the instant a new login or credential refresh happens.