# Security

Security is enforced in the API and deployment topology, not by UI visibility. The current baseline includes tenant owner filters, local/Google/Microsoft identity options, cookie CSRF protection, rate limits, TOTP, session revocation, validated uploads/imports, bounded document parsing, private AI networking, and structured error handling.

- [Authentication](authentication.md)
- [Authorization and tenancy](authorization.md)
- [Sessions and rate limits](sessions.md)
- [File and import security](file-security.md)
- [Current findings and verification limits](security-notes.md)

Historical audits remain recoverable in [`../_archive/`](../_archive/); only verified current claims belong here.