Security and data sovereignty

True today, in the shipped system

• Your records are isolated at the database row. Every table enforces row-level security: your operation's data is readable only by your operation. This is enforced by the database engine itself, not by application code.
• No farm data leaves. Ever. When the research desk works a question, the question travels bare: your name, your acres, and your records are never attached to anything outbound.
• Vendors never see who you are.Farmer identity and acreage are confidential by standing rule: never shown to vendors, never priced against, never packaged.
• The books cannot be silently rewritten.Inventory movement and corrections run on append-only ledgers: nothing edits or erases an entry, corrections happen by addition, and history stays whole.
• Privileged operations are walled off.Administrative database credentials never ship in the application; they live only in isolated server functions and offline jobs.

Roadmap, labeled as roadmap

• SOC 2 attestation. The controls above are the substance of a SOC 2 program; the formal work of written policies, evidence collection and independent audit is underway, Type I first, Type II over an observation period. We will publish status here as it lands, and we will not claim the badge before the auditor grants it.
• USDA and FSA data handling standards.We are mapping our controls against the standards federal agencies apply to producer data, with the stated aim of meeting them and clearing them with room to spare.

Summary

Your data is yours, is shown to no one, and works only for your operation. This page is updated as the roadmap items land; nothing is claimed before it is done.