Security

Every business table enforces row-level security scoped to the owning account, so records are only readable and writable by their owner. Roles are stored separately from profiles and checked through a security-definer function, so a user cannot escalate their own role.

Uploads go to a private bucket. Objects are stored under a per-account folder and the access rules require the folder to match the signed-in account, so files are not shared across accounts and are not publicly listable.

Service credentials and API keys are held server-side only and are never shipped to the browser. Public webhook and lead-capture endpoints require a token that you can revoke at any time from the endpoints module.

Approvals, decisions, deployments and automated runs write to an append-only audit log that cannot be edited or deleted from the app, so the history of what was approved and what ran stays intact.

If you believe you have found a security issue, contact the platform operator with steps to reproduce and give us a reasonable window to fix it before disclosing publicly. Please do not run automated scans or access data that is not yours while testing.