Trust & evidence

Verifiable, not vouched for

The platform’s security model in plain language: what is immutable, where data lives, and how destruction is proven.

signed recovery point manifest • illustrative
Immutability

Immutability by default

Recovery points carry rolling locks that renew daily. Suspension for non-payment never shortens existing immutability; a commercial failure must not become a data-loss event.

Residency

Residency as a boundary

Each organization chooses its storage location from your allowed set; a residency preflight confirms the region before the first capture.

Destruction

Certified destruction

When retention ends and destruction runs, a signed certificate is issued, and it outlives the data it certifies.

Identity

Read-only by design

Backups run under a consented read-only identity; writes exist only during restores, just-in-time, and revoke themselves.