Flooring

Customer, provider, and administrative data is served only after server-side tenant and permission checks.

Payments, uploads, notifications, and audit events fail closed when a required production binding is unavailable.