Private object storage
Files are stored privately and served only after authorization.
Business-scoped access
Server queries check membership before returning business data.
Secure uploads
File type, size, and signature checks run before storage.
Activity logging
Important record changes are attributed and recorded.
Authentication and sessions
Verified email authentication and secure, HTTP-only session cookies protect customer workspaces. Passwords are handled by the identity provider and are not stored in application business tables.
Authorization
Owner, admin, and member roles are enforced server-side. Record identifiers alone do not grant access; protected queries are scoped through the authenticated user’s business membership.
Document access
Uploaded content is not served from a public object URL. Download routes verify user identity, business membership, and audit ownership before reading a stored object.
Secure processing
Uploads are limited by type and size and checked for expected file signatures. Sensitive provider credentials are stored as server runtime secrets and are never included in client code.
Responsible disclosure
Report suspected vulnerabilities using the security option on the contact page. Do not include customer data in the initial report. We do not claim certifications that have not been independently completed.