This schedule records candidate contractual measures and the evidence needed to promise them. Repository tests demonstrate bounded application behaviour, not all production operations. Before signing, replace pending status with verified measures or remove/qualify the affected commitment with counsel and customer agreement; no silent downgrading.

Tenant isolation. Application or preparation evidence: Tenant-scoped repositories, organisation keys, PostgreSQL RLS and two-organisation regression tests. Production acceptance evidence still required: Production runtime role/RLS checks; no superuser or BYPASSRLS; sample denial with two synthetic tenants.

Access/authentication. Application or preparation evidence: Role checks, session controls, time-bound privileged support paths and audit. Production acceptance evidence still required: Staff access inventory, least privilege, revocation review, MFA coverage and deployed cookie/callback verification.

Encryption/secrets. Application or preparation evidence: Credential vault and environment validation; direct Node deployment contract. Production acceptance evidence still required: Actual TLS session, at-rest encryption, secret-store/rotation evidence; Render private DB self-signed TLS trust model must be disclosed accurately.

Files/imports. Application or preparation evidence: Private-object delivery authorisation and scanning/conversion readiness paths. Production acceptance evidence still required: Production bucket public block, least-privilege keys, quarantine/fail-closed behaviour and scanning evidence for approved file types.

Confidentiality. Application or preparation evidence: Restricted intended support and processing roles. Production acceptance evidence still required: Staff/adviser confidentiality obligations, training and joiner/mover/leaver records.

Secure development. Application or preparation evidence: Pinned dependencies, format/lint/types/unit/build and tenant regressions. Production acceptance evidence still required: Release approval, current dependency/vulnerability review, independent testing scope/results; no SOC 2/ISO claim.

Logging. Application or preparation evidence: Redacted/limited application diagnostics and audit models. Production acceptance evidence still required: Central destination, access restrictions, actual log retention and redaction samples.

Incident response. Application or preparation evidence: Runbooks, external monitor tooling; hello@beetl.net test email receipt confirmed by owner. Production acceptance evidence still required: Live independent monitor/watchdog, provider alert routing, named responder/backup and tabletop; test mail is not ongoing monitoring.

Recovery/continuity. Application or preparation evidence: Isolated DB and synthetic object recovery tooling/tests. Production acceptance evidence still required: Real paired DB/files restore, immutable backup policy, retention/regions, approved measured RPO/RTO.

Retention/rights. Application or preparation evidence: Owner export, confirmed organisation deletion and private-object cleanup paths. Production acceptance evidence still required: Complete learning/media/account/export coverage, deadlines, identity/agent/appeals handling and deletion proof.

Provider control. Application or preparation evidence: Proposed Render/Cloudflare architecture and dependency inventory. Production acceptance evidence still required: Signed DPAs, legal entities, location/access/retention facts, subprocessor notices and executed transfer protection.

Capacity/availability. Application or preparation evidence: Short synthetic workload checks; serving memory inspected. Production acceptance evidence still required: Sustained deployed multi-user save/import/job and whole-process memory evidence; no uptime/capacity guarantee.