Minimum access by design.
The enterprise path is built around Quantum Airlock and minimum customer access: signed, redacted cryptographic evidence leaves the customer boundary; source code, private keys, secrets, and packet payloads do not leave by default.
What Leaves
Algorithm family, cipher suite, TLS version, certificate metadata, package hash, firmware hash, CI findings, runtime crypto metadata, and policy results.
Salted host, repository, component, service, and device fingerprints when the customer chooses privacy-preserving mode.
Ownership metadata, remediation state, validation result, audit events, and compliance ledger references.
What Never Leaves By Default
No source-code upload is required for the Airlock-first workflow.
No private keys, tokens, passwords, PEM keys, or cloud credentials should be submitted.
No raw packet payloads, customer records, production data samples, or broad filesystem images are required.
Production Controls
Header auth is local/dev only. Production must use hosted JWT identity, least-privilege secret management, managed Postgres, managed Redis, and verified row-level security.
Use MORROW_AUTH_MODE=jwt, MORROW_AUTH_REQUIRED=1, real issuer/audience/JWKS, and MFA in the identity provider.
Set MORROW_AIRLOCK_SIGNING_KEY and MORROW_AIRLOCK_REQUIRE_AGENT_SIGNATURE=1 for enterprise pilots.
Archive go-live gate, launch collateral check, backup/restore, browser smoke, tenant isolation, and Trust Passport outputs.
Buyer Review References
For a security review, read the data boundary, the deployment guide, the Trust Passport overview, and support and incident response. Your account team can share the full security questionnaire under NDA.
Customer-controlled AI
AI is off until an organization admin approves a Data Control policy. Review the local filtering kit, read-only assistant, support permission and signed gateway receipts, with their explicit limitations.
AI data controls