The MVP policy prohibits CUI, classified information, export-controlled technical data, and sensitive customer data. The analyzer requires explicit public-only acknowledgment, but production DLP, malware scanning, retention, and access controls are still required.

Production uploads are intended to use private Supabase storage buckets with metadata stored separately from file bytes.

Tenant-scoped data models include organization_id, with helper checks in code and RLS policy notes that must be enforced before production.

The schema includes audit_logs for uploads, analyses, exports, evidence changes, profile changes, and billing events; route-level writes still need implementation.