Relmz runs on Postgres 16 with one database per tenant. Sessions are HttpOnly cookies — no tokens in localStorage. Stripe handles all payment data; we never see card numbers. Backups are per-tenant; restore is per-tenant; blast radius is per-tenant.
SOC 2 Type 1: in progress (target Q3). HIPAA: out of scope for v1.