Trust Center

Workspace isolation

• Authenticated workspace data is protected by database-level tenant isolation in Neon Postgres.
• Tenant requests run through a non-bypass runtime role and validated organization membership.
• System-level database access is reserved for narrowly scoped authentication, maintenance, payment, payout, and scheduled jobs.

Authentication

• Neon Auth is the account and session authority for email/password and supported social sign-in.
• Active workspace selection is checked against live membership before tenant data access is established.
• Session cookies are HTTP-only, secure, and scoped to the Vite.cite application.

Payments and payouts

• PayOS payment state is provider-verified before paid access is activated.
• Payment activation is idempotent so provider retries cannot extend access twice.
• Creator payout account numbers are encrypted before storage, and payout operations fail closed when required provider controls are unavailable.

AI and evidence provenance

• Simulation previews are labeled as simulations and are not presented as direct live answers from third-party AI products.
• Observed citation evidence is stored separately from simulated preview data.
• Claims that need evidence remain identified as such rather than being silently promoted into facts.

Bring-your-own-key

• Raw provider keys entered for BYOK generation are intended for the current browser session and execution path, not permanent application storage.
• Users remain responsible for their provider account permissions, billing, and key rotation.

Public beta

The public beta is production software, but some capabilities remain intentionally marked rollout, preview, or unavailable until their delegated runtime is connected and verified. Vite.cite does not present an unavailable capability as a successful execution.