Identity
Google-only OAuth, server-side sessions and an independent WhatsApp verification gate.
SECURITY MODEL
Boundaries are explicit.
Authorization
Tenant membership roles are checked on every protected resource request.
Privacy
Monitoring accepts operational metadata only. Strict validation rejects undeclared content fields.
Auditability
Sensitive writes carry request IDs, rate limits and append-only audit records.