What happens to an expression after you press evaluate.
Each expression is evaluated in its own worker process, confined by kernel policy: the syscall filter and filesystem rules refuse file, process and network access, and functions that would reach outside the computation are blocked by policy before the engine sees them. A runaway evaluation is killed with its process; it cannot outlive its budget or touch another user's work. Sessions that keep state between calls are private to your account and are dropped after thirty minutes idle.
Passwords are stored as Argon2 hashes, never as anything reversible. TOTP two-factor authentication is available on every account. API tokens are shown once at creation, held hashed, and revocable one at a time. OAuth grants to connected applications are scoped, listed on the MCP page, and revocable there.
Cards are handled by Stripe on Stripe's servers; a card number never reaches ours. Organizations can instead pay by invoice or cheque, recorded against the term by an administrator.
Traffic is TLS. There is no SOC 2 report, no single sign-on and no SCIM yet - each is built when a real procurement asks, and the organizations page says the same thing. If your review needs a specific artifact, ask; the answer will be a date or a no, not a maybe.
Write to support@qurak.com with what you found. Reports are read by the people who can fix them, and we would rather hear it from you than find it in a log.
If the report is sensitive, encrypt it to the key below; check the fingerprint against the copy on keys.openpgp.org before you trust it.
Both addresses, both keys and how to verify them are on the contact page.