• Uploaded files and generated benchmark artifacts are scoped to the owning authenticated account.
  • Signed artifact links are short-lived when presigned access is enabled.
  • Server-side secrets such as provider keys and webhook secrets are not exposed to browsers.
  • Operational logs and stored artifacts may be retained according to platform settings, billing needs, and abuse-prevention controls.