Data handling

Metadata only. Never record data.

The short version, ahead of the full one-pager:

• What we receive: a metadata export you produce yourself — flows, Apex, objects, rules, permissions. Configuration, not contents.
• What we never receive: record data. No accounts, no contacts, no opportunities, no PII from your CRM. The engine has no connection to your org — there is nothing to install and no OAuth grant to approve.
• Where it lives: your export is processed on hardware we control, in an isolated per-client store, and deleted on the schedule agreed in your engagement.
• What you get back: the briefing artefact is yours to keep. The engine never ships; deliverables do.

A detailed data-handling one-pager for your security team is part of every engagement — ask for it when you book an audit.