Security overview

• Workspace access is private to each client organisation — users join only by owner-controlled invitation.
• Every user has an individual account with a hashed password; sessions are signed and can be revoked instantly.
• Roles (owner, admin, manager, reviewer, viewer) limit what each user can see and do, enforced on the server for every action.
• The platform owner's cross-tenant access is audited, and a read-only 'view as client' mode blocks writes.

• Every record belongs to exactly one organisation, and every query is scoped to the caller's organisation server-side.
• One client can never see or export another client's data; isolation is enforced in code, not just in the UI.
• AI job execution and local job backups are scoped to a per-organisation directory.

• Data is stored in a managed PostgreSQL database with provider-managed backups.
• Payment card data is handled by Stripe; we do not store full card numbers.
• Exports contain business fields only — no secrets, internal metering or payment card data.
• Secrets and credentials are never exposed to the browser or included in any export or document.

Sensitive platform actions — access, billing adjustments, pauses, offboarding, deletion — are recorded in an append-only audit trail with the actor, organisation, time and reason.

The service never contacts a prospect automatically. Human approval is required before any prospect contact, and the approval decision is recorded.

If you believe you have found a security issue, please contact us privately (see SECURITY.md in the code repository). Do not publicly disclose it until we have had a reasonable chance to respond.