Security

No compliance certification is claimed. These are the architectural principles this platform is being built against.

• Tenant isolation is constitutional -- every commercial-plane authorization check keys on organization, project and environment, never a frontend filter.
• No commercial customer receives direct unrestricted PostgreSQL authority over United Valuta's internal database.
• Customer application users are never mixed with United Valuta consumer membership, even where the underlying auth technology is compatible.
• Payment/billing state never grants Founder authority, KYC decision authority, Wallet signing authority, Monetary Engine authority, or internal infrastructure authority.
• Secrets shown to customers use reveal/reset flows, never plain display of long-lived credentials.