Where data lives, how it's protected, and what the agent is allowed to do.

A single managed Postgres instance is reached through the Prisma client singleton. No raw SQL reaches the database from app code, no second datastore sees customer rows, no shadow backup pipeline synchronizes data outside the platform.

Region is selected at provisioning on the Render-managed provider. EU and UK data residency are available alongside the US default — the choice is recorded against the environment and held for the lifetime of the account.

Customer rows are never mirrored into an analytics warehouse, an event-stream topic, or a third-party data lake. The audit log on Enterprise is generated from the same Postgres — not a separate datastore.

Cron jobs are declared in polsia.toml and run with environment-injected credentials, not stored secrets. No job reads customer rows outside the same Prisma singleton used by the application.

Render-managed HTTPS fronts every request; nothing between a signed-in browser and the application speaks cleartext. The same TLS posture covers /api, /app, and the public marketing surfaces.

Postgres storage is encrypted at rest by the managed database provider. Volume snapshots and point-in-time backups inherit the same key-set — the application never sees an encryption key or a plaintext table.

All secrets — database URL, session signing, email proxy, Stripe — are read from validated env on the server. The deploy platform injects values at boot; no secret is committed to the repo or read at build time.

Sessions are HttpOnly cookies issued by better-auth, scoped to the production origin. There is no custom admin cookie, no shared-password fallback, and no token stored in localStorage — the session shape is the same shape the auth module publishes.

The agent reads spend, vendor catalogs, and counterparty responses from the same Postgres the rest of the app uses. Reads do not require approval — but no write action is taken without an explicit human sign-off.

Counter-offers, vendor outreach, and discount requests all route through the /app/approvals queue. Finance approves, amends, or rejects each draft from one queue before a single message is sent.

The three-phase loop — Audit, Reclaim, Renegotiate — is documented on /how-it-works. Each phase is logged with timestamps, request payloads, and the named human who signed off the write action.

Nothing reaches a vendor counterparty without a signed sign-off row. Even an AI-written counter-offer sits in the approvals queue until a name on the team approves it — there is no automatic send path.