Identity
Assigned Microsoft sign-in, server-side sessions and current Kew membership. An email domain alone does not grant access.
SECURITY AND ACCESS
Clear boundaries. Evidence before assurance.
Authentication, source-owned permissions and reviewable actions are part of the platform foundation. Confirm the exact deployment scope before sharing business data.
What the current corporate host verifies
Data boundaries
A separate corporate PostgreSQL database, private network access, managed workload identity and forced row-level scope checks.
Accountable changes
CSRF-protected authenticated writes, expected versions, durable retry receipts and minimized events on the accepted paths.
Assurance has a scope
Full-platform production acceptance, sustained workload, coordinated disaster recovery and delivered operational alerts remain open. We do not claim SOC 2 certification, HIPAA compliance, unlimited capacity or a universal deployment SLA.
The website is public marketing. Actual application work requires an authorized private workspace. Customer identity providers and self-service onboarding need their own qualification.