01Product scope
FamilyOffice runs on the Stitchaxis platform infrastructure. This page describes product-scoped controls — org isolation, access gates, and data handling — not a separate SOC 2 certification for each engine.
02Workspace isolation
Customer data is scoped to the signed-in organization. Row Level Security (RLS) enforces org boundaries on subscriptions, usage, memory, and operator tables. Browser clients do not receive grants on operator-only tables.
03Access controls
Production admin routes require founder-level authorization. API keys are stored hashed and scoped to the issuing organization. Execute routes check entitlements before running engine workloads.
04Data handling
Data in transit uses TLS. Session inputs and engine outputs remain within your org scope unless you explicitly export them. We do not sell customer data or use it to train third-party models without a separate agreement.
05Platform security
For the full Stitchaxis platform security overview — founder-only admin, RLS, Stripe webhook verification, rate limits, and what is not yet certified — see the platform security page.