Security you can explain to your customers

• TLS in transit; credentials encrypted at rest
• Widget domain allowlisting and optional JWT verification
• Rich cards render only from successful tool results
• Role-based access, audit trail, webhook HMAC signatures
• GDPR-supportive: DPA available on request