Explicit trust.
Bounded access.

Verified distribution

Release manifests are signed with an ECDSA P-256 key held in Azure Key Vault. Installers verify the pinned publisher key, manifest signature, selected archive size, and SHA-256 before running it. Versioned releases are immutable; a release cannot replace an earlier file at the same URL.

Your platform credentials

Project tokens are stored in Windows Credential Manager, macOS Keychain, or Linux Secret Service. There is no plaintext fallback. Sign-in links and PayPal approval stay in your browser, not an agent conversation.

Native signing during beta

Windows native signing and Apple notarization are not yet provided. Your operating system may show a warning. Review the verified publisher and approve only through supported operating-system controls. Never disable SmartScreen, Gatekeeper, antivirus, execution policy, or quarantine protections to install Standup.

Tenant and service boundaries

Managed projects use authorization from authenticated server state and PostgreSQL row-level security. Database and secret services use private networking. Backups are encrypted and have bounded retention. The beta opens only after isolation and recovery acceptance.

Report a concern

A private reporting contact will be published before beta enrollment opens. Send a concise description and safe references. Do not send credentials, source code, prompts, transcripts, or unrestricted database exports.