Trust is evidence, not a promise
LoomLab publishes the controls that are actually implemented and names missing evidence explicitly. These statements describe the current product posture; they are not a certification or service-level agreement.
Tenant data isolation
enforcedSupabase Row Level Security is exercised by the repository verify:rls control and migration checks. Production advisor evidence is remeasured for each security release.
Governed engineering exports
availableValidation reports and maintenance records have authenticated, project-bound export paths. A whole-account portability bundle is not yet available.
Backup and restore drill
evidence pendingManaged database backups are not represented here as a tested restore. A dated restore-drill receipt is required before this control can be described as verified.
Uptime monitoring
evidence pendingDeployment health is observable through Vercel, but no public service-level objective or independent uptime monitor receipt is currently published.
Application error monitoring
partialStructured redacted server logs are implemented. Sentry is not configured, so LoomLab does not claim Sentry coverage.