Custody is the security model.

# common.py — the Collector every adapter writes through
def add_person(self, source, name, …, email="", phone="", …):
    if not name or EMAIL_RE.search(name):
        return  # never store a "person" whose name is an email
    # PII only enters in full mode; otherwise coerced to ""
    email = (email or "").strip() if self.full else ""
    phone = (phone or "").strip() if self.full else ""

def add_message_signal(self, source, party_name, date="", ts=""):
    """Records ONLY that a message exchange happened + when. Never the body."""

# company/slack.py
# NOTE: m.get("text") deliberately NOT read.

# company/google_workspace.py
QUARANTINE = {"payroll", "salaries", "loginaudit", "passwords", …}