Platform protection

Security

White-label access remains tenant-scoped, permission-controlled, rate-limited, and audited.

Credential isolation

API secrets remain server-side and are stored using the existing protected keyring.

Organization API requests use timestamped, nonce-protected HMAC signatures.

Domains, providers, branding, account members, webhooks, and sensitive configuration changes remain traceable.