Encryption

TLS in transit; encryption at rest.

RBAC

Granular roles; 2FA recommended.

Audit

Action logs retained 90 days.