Security by narrow design

No general file uploads, no AI processing, no client-payment custody, scoped client access, server-authoritative timing, and strict tenant isolation.