Boring on purpose.

${[ ["Encrypted at rest","All data is AES-256 encrypted at rest. Customer-facing data is sharded by workspace and encrypted with rotating per-tenant keys."], ["Encrypted in transit","TLS 1.3 with HSTS, certificate pinning on mobile clients. We never accept HTTP. Cert renewal is automated through ACME."], ["Data residency","US (us-east-1) by default, EU (eu-west-1) on request. Studio plan supports per-workspace residency selection at signup."], ["Backups","Hourly incremental, daily full, retained 30 days. Restore tested monthly. Disaster recovery RPO 1 hour, RTO 4 hours."], ["Data export","You can export your full workspace at any time as JSON, Markdown, or CSV. No upsell wall, no waiting period."] ].map(([h,p]) => ``).join("")}

${[ ["SSO","SAML 2.0 with Okta, Google Workspace, Microsoft Entra. Auto-provisioning via SCIM. Studio plan."], ["MFA","TOTP, WebAuthn, hardware keys. Can be required at the workspace level by an admin."], ["Permissions","Role-based per workspace, with custom roles on Studio. Guest seats are scoped to specific boards only."], ["Audit log","Every admin action, permission change, and access event is logged with the actor, IP, and timestamp. Exportable as CSV."] ].map(([h,p]) => ``).join("")}