Security posture

• Row-level security — every nx_ table has ENABLE + FORCE RLS; tenant context via transaction-local GUCs. Cross-tenant reads fail at Postgres, not in code.
• Keys — stored as SHA-256 hashes, shown once. Per-app+env RS256 signing pairs; private keys AES-256-GCM at rest.
• Passwords — argon2id; imported legacy hashes verified then rehashed forward.
• OTPs — hashed at rest (app-scoped), 5-attempt cap, 5-min expiry, 10/min IP + 10/hour/identifier flood caps.
• Tokens — RS256, kid-rotatable, JWKS public, 15-min lifetime, rotating refresh.
• Bootstrap — fail-closed admin token; no open provisioning.
• Ledger — hash-chained credit ledger, tamper-evident.
• Infra — dedicated DSN seams; the service runs standalone with its own PG/Redis/KMS.