Evidence is read-only and field-allowlisted. Observations do not mutate source. Exports need purpose, legal basis and dual approval for sensitive sets; CSV is formula-escaped, encrypted with a one-time DEK, and download TTL is not extended on retry. Privacy deletion queues soft-delete for Prompt 24.

Members change profile data only through requests — never direct secure writes. Transfers need source and destination approval. Merges use survivorship + tombstone (no hard delete). Status and visible-field changes trigger ID-card refresh.