Platform safeguards
Tenant isolation
Every record is scoped to an organization and enforced with row-level security policies on each table.
Role-based permissions
Roles are stored separately from user profiles and checked server-side, so privileges cannot be escalated from the client.
Authentication controls
Email verification, one-time verification codes, password reset and session controls on every account.
Encryption
Data encrypted in transit and at rest, with document storage held behind authenticated, access-checked URLs.
Immutable audit logs
Approvals, status changes, financial postings and document actions are appended and never edited in place.
Secrets management
API credentials and signing keys are stored in managed secret storage, never in application code.
Operational practices
- Least-privilege access reviews on every policy change
- Rate limiting and abuse protection on public endpoints
- Verification codes stored hashed, single-use and short-lived
- Backup and recovery procedures with restore testing
- Vulnerability and penetration testing before production launch
- Control mapping prepared for SOC 2 and NIST reviews
Responsible disclosure
If you believe you have found a security issue, contact us before disclosing it publicly. We investigate every report and will confirm receipt.