Security and governance

Blocchi treats security as a platform boundary, not a UI convention.

Core controls

• Tenant role and viewer data scope are resolved server-side.
• Product entitlement does not automatically imply implementation readiness.
• Provider credentials and service secrets stay server-side.
• Source-specific Agent/Data+ read and write policy is cumulative with RBAC and connector capability.
• Consequential actions use registered capabilities, approval/confirmation, idempotency and audit evidence.
• Data retention and subprocessor information have dedicated public transparency surfaces.

SOC 2

Blocchi has implemented a structured SOC 2 readiness and Type II operating-evidence program in the repository, including control calendars, evidence registers and operating checks. That is not the same as claiming a completed independent SOC 2 report. Public claims should continue to distinguish implemented controls/readiness work from auditor-issued assurance.

Headless access

REST and MCP resolve through the same actor context. Neither transport allows a client to supply a tenant ID, role or scope as an authorization claim.