Everything below is a rule the database enforces, not a policy we ask our code to remember. Where a rule is not built yet, it is listed at the bottom instead of implied at the top.
Every table has row level security. A query that forgets to filter by organization returns nothing rather than someone else's rows, and a workspace can be restricted to named people inside your own company.
Uploads go straight from your browser to storage through a short-lived signed URL, and downloads come back the same way. There is no route in the application that file bytes travel through.
One key can read across organizations. Every module that touches it is marked server-only, so a build fails rather than shipping it to a browser.
Retrieval runs inside a database function that takes the workspace as a required argument and filters on it there. The isolation is not something a caller can forget to apply.
Only the passages retrieved for one request are sent to the model, never a whole file and never another client's material. Your files are not used to train models.
Deleting a workspace deletes its files, their extracted text and every passage indexed from them, by a foreign key rather than by a cleanup job that might not run.
Three services, each doing one thing. We list them because a buyer's security review will ask, and the answer should not take a week.
Said here rather than discovered during your security review.