Every record is treated as sensitive. Access is gated by login and role — with a permission matrix you control, toggle by toggle.