Designed to minimize sensitive child data

Tenant isolation, default-deny permissions, restricted workspaces, append-only evidence and fail-closed safety paths are built into the operating model.

Review demo controls For institutions

Tenant boundaries

Every server and repository operation carries tenant context; identifiers alone never grant access.

Restricted data

Medical, counselling, discipline and custody details use separate authorization and are excluded from broad search/cache.

Honest posture

This foundation does not claim certification or legal compliance. Production gates and residual risks remain explicit.