Security by architecture
These are engineering facts about how the platform is built — each backed by automated tests, not marketing claims.
Strict tenant isolation
Every query is organization-scoped; cross-tenant access attempts return 404, never data. Isolation is covered by explicit attack tests in CI.
Three separate credential domains
Organization sessions, client-portal sessions and platform-operator sessions use separate cookies, tables and hash prefixes — plus a fourth domain for API keys. No token can cross a boundary.
Secrets encrypted and write-only
SMTP, WhatsApp and webhook signing secrets are AES-256-GCM encrypted at rest, never returned by any API, and redacted from logs. API keys and all auth tokens are stored as hashes only.
Cryptographically verified webhooks
Inbound billing/payment/WhatsApp webhooks are HMAC-verified over the raw body with replay protection; outbound webhooks are signed (t=…,v1=…) with rotatable secrets.
Server-side pricing everywhere
Checkout amounts, plan prices and invoice totals are computed server-side from the database — browser-supplied prices are never trusted.
Immutable financial history
Issued invoices, payments, receipts and e-signature evidence are never silently mutated; corrections are explicit (void/credit) and audited.
Auditing at two levels
Organization-level audit logs for sensitive actions, plus an immutable platform audit trail for operator actions — impersonation is time-limited, reason-required and always visible.
Data ownership
Owners can export the organization's full data (secrets excluded by construction) and schedule deletion with a cooldown — no silent destruction, no vendor lock-in.