Private by design · Company access stays scoped