Every public operation checks the Auth0 token, the scopes and household membership. PostgreSQL also enforces isolation rules. Private processing tools are not part of the public MCP. Uploads are limited in size and type; mutations use replay keys. Isolation tests, the Docker build and a synthetic restore run in CI. These controls are not a certification. Report a vulnerability privately to the operator; do not exfiltrate any data or test on a real household without permission.
Operator: Armelle Tepong — Bazous
Contact: contact@bazous.com