Security overview

Actual controls in the current build. No certifications are claimed.

• Tenant isolation. Every customer table carries an organization id and a PostgreSQL row-level-security policy that is forced for all roles. Application code sets the tenant context from an authenticated membership, never from a request parameter. Automated tests attempt cross-tenant reads, writes, updates, and deletes on every release.
• Authentication. Identity is provided by Firebase Authentication (Google or email/password). Sessions are server-side rows referenced by an HttpOnly, Secure, SameSite cookie and can be revoked individually. Cross-site requests are rejected on mutating endpoints.
• Authorization. Roles: owner, admin, analyst, viewer, billing. Billing users cannot access product, transaction, or shipment data. API keys are scoped and tenant-bound.
• Uploads are untrusted data. Spreadsheets are parsed, never executed; macros and external links are ignored. Exports neutralize formula injection. Documents and web pages are treated as content, never as instructions, when AI assistance runs.
• Outbound fetches. Official-source fetches go through one controlled client with size caps, redirect limits, and private-address blocking.
• Secrets. No credentials in the repository or browser bundle; server-only variables are documented in ENVIRONMENT.md.
• Audit trail. Sign-ins, organization changes, exports, integration changes, and rule publications are recorded without document contents or secrets.
• Deletion. Organization deletion revokes sessions and keys immediately, then purges tenant data; retention defaults are documented in SECURITY.md.

Questions: support@example.com