Security and data

This page describes what the application actually enforces, so you can answer a client or a security questionnaire without guessing.

Access control

Permissions are enforced in the database, not in the interface. Every table carries row level policies that check the caller's role, so a button that leaks through into the interface still cannot write. Hiding and blocking are separate layers, and blocking is the one that counts.

Each member holds exactly one role in each organisation. A role grants none, view or edit on projects, quotes, plans, catalogue, customers, tasks and tickets, plus flags for seeing cost and margin, being limited to assigned projects only, managing members, editing settings and managing billing. The Owner role bypasses capability checks and cannot be edited or deleted.

Costs and margins are a capability: members without it are put into a customer-safe view where margin is not shown.

Tenant isolation

Data belongs to one organisation and is reachable only by its members. Child records resolve up to their parent project or organisation, and writes are checked against the parent rather than against a value the browser sends, so a record cannot be attached to another organisation's plan or project.

Client-facing offer and quote pages are rendered on the server and read a single record by id. The browser key that ships with the app cannot read business tables at all.

File storage is scoped the same way: logo and avatar uploads can only be written to your own organisation's or your own account's folder, though both remain publicly readable because logos appear on client documents and avatars are shown to teammates.

Encryption and secrets

Sensitive fields are encrypted at rest with AES-256-GCM, with the key held only on the server: device credentials, offer passwords, and bank and IBAN details. The browser holds ciphertext and asks the server to reveal a value on demand.

API keys are stored hashed. Only a short prefix is kept readable, for lookup.

Sign in

Sign in is email and password, with a CAPTCHA on the login and signup forms and email confirmation on signup. Password resets are done by emailed link. You can sign out all other devices from the Sessions tab under Account.

Two-factor authentication is not available yet. The toggle on the account Security tab does nothing, and neither does the change password form on that tab: use the forgot password link instead. Single sign-on and SAML are not built.

Auditing

API and MCP calls are logged per call with the key, organisation, action, result and duration. Argument content is only logged when that is explicitly switched on for the deployment. In-app changes are visible through document versions, project timelines and comment threads rather than through a single organisation-wide audit log, which does not exist yet.

Deletion and export

Deleting an organisation is Owner only, requires typing the organisation name, and permanently removes its projects, quotes, customers and members. There is no undo and no self-serve restore, so take copies of anything you need first.

Cancelling a subscription is not deletion. Modules switch off at the end of the billing period and your data stays readable.

There is no one-click account or organisation export yet. Documents can be exported individually as PDFs, and the read-only API can pull data out programmatically if you need a copy at scale.