Tenant isolation at the database layer
Every organization's data carries a tenant identifier, and PostgreSQL Row Level Security guarantees that no query — however crafted — can read another tenant's rows. Application code sets the tenant context only after verifying membership.
Server-enforced permissions
Roles (owner, admin, manager, member, viewer) are checked on the server for every operation. Hiding a button in the interface is never treated as protection.
Authentication done properly
Email verification, secure password hashing, session management and password reset via the auth provider. Super-admin accounts are MFA-capable and fully separated from tenant administration.
Append-only audit logs
Sensitive actions — logins, permission changes, subscription events, tenant suspension — are written to an audit log that application roles cannot modify or delete.
Encrypted in transit and at rest
All connections use TLS. Database encryption at rest and automated backups are provided by the managed Postgres platform, with tested restore procedures.
No secrets in code
Credentials live in the secret manager, never in source code, logs or frontend bundles. Production and development environments are strictly separated.
Responsible disclosure
Found a vulnerability? Email security@[domain] and we will acknowledge within 48 hours. (Address finalized at commercial launch.)
Honest scope
No system is unhackable, and we won't claim otherwise. What we promise: isolation by design, least-privilege access, full auditability, and a documented incident response process before we accept real customer data.