TLS 1.2+ Pflicht, Argon2id-Passwort-Hashing, JWT RS256 mit Schlüsselrotation, PostgreSQL Row-Level Security, Rate-Limiting pro Tenant, Responsible Disclosure via security@signaturehub.de.