Security, privacy and retention
What is implemented now and what still requires formal review.
Google sign-in, server-side sessions, security activity and fail-closed service preflight have real seams. Retention/deletion policy controls and formal contractual processing language remain under review.
Current status
This guide documents the first customer-control-plane tranche. It does not imply that paid production, billing, public endpoints or unfinished controls are live.