Security — What we don't have yet (2)

• No script-source restriction in the content-security policy. Described in section 05 — real work rather than a missing header. • No customer-managed encryption keys, and no choice of data region. Everything runs in the United States. • No FedRAMP or government authorization. Do not put government data with a handling requirement in RowFold. Health data is different — we sign Business Associate Agreements on request, so contact support to start one; see Compliance for what a BAA does and does not cover. • No contractual uptime guarantee. We do not offer an SLA today.