Security

Where bytes live, what the parsing models can reach, and what fails closed.

Where bytes live, and what reads them

Uploaded bytes go to quarantine storage and are disarmed before anything reads them. Parsing models get no tools, no broad credentials and no outbound network: every document is treated as hostile input.

What fails closed

Integrity violations fail closed. A World with an unresolved link is not emitted, a package whose file digests do not match is not served, and a compile whose inputs cannot be validated does not produce a partial result.

Note The Security page states the controls in full and the Subprocessors page names every service permitted to touch each class of data. This section does not restate them.