Scope minimisation is architectural — the collector records that context was retrieved, not what it said.
Per-user identifiers can be stripped at collection, with reporting fixed at team level.
Every run is replayable and tamper-evident, with a full audit trail for regulators.
Encryption in transit and at rest, with configurable regional data residency.