Controls we can actually run.

No SOC 2, ISO, EU-residency, or private-deployment claim is made here. Those require evidence. What ships now:

• Tenant isolation on API, D1, R2, and logs.
• Magic-link confirmation so email scanners cannot consume a credential.
• Hashed OTP and magic-link secrets. Raw tokens never enter analytics.
• Hard spending caps with Durable Object reservations.
• Suppression rechecked at final activation.
• Transactional auth mail on Cloudflare Email Service. Sales send uses the customer mailbox.

Subprocessors and a data-flow register will be published before public paid launch.