Security you can
actually trust.
Tenant data is sensitive. We treat it that way. Organization-scoped isolation, role-based access control, an immutable audit trail, and automated data retention — built in from day one.
How we protect your data
Org-Scoped Isolation
Every tenant-scoped record carries the organization it belongs to, and that value is taken from the authenticated session — never from a request body. There is no code path where a client can ask for another organization's data.
- Organization scope resolved from the session, never client-supplied
- Per-resource permission checks on every API call
- Soft deletes only — records are never hard-deleted out from under an audit
- Tenant and owner portal access can be revoked instantly
Role-Based Access Control
Access is gated by role on every operation. Tenants see only their own tenancy, owners only their own portfolio, and staff only what an admin has granted them.
- Roles: Super Admin, Org Admin, Manager, Staff, Tenant, Vendor and Owner
- A per-staff page-permission layer on top of roles
- A separate commercial entitlement layer — a subscription never grants a permission
- The AI acts within the signed-in user's role and gets no ceiling of its own
Audit Logging
Every create, update, delete, and status change is logged with a timestamp, actor, and before/after snapshot — including everything the AI does on its own.
- Immutable before/after audit trail on every mutating operation
- Autonomous AI actions recorded distinctly, with the reason they were permitted
- Who approved which AI draft, and when
- Exportable for compliance review
Authentication
Authentication is handled by Clerk — a dedicated auth platform with session management and organization-level controls. Access to the product is invite-gated today.
- Multi-factor authentication available via Clerk
- Organization-level role assignment
- Session expiry and revocation
- Webhook-verified user sync
Infrastructure
Deployed on Vercel with a managed Neon Postgres database. Encryption in transit and at rest is provided by those platforms.
- Encryption in transit and at rest via Vercel and Neon
- Serverless compute — no persistent attack surface
- Environment variable isolation per deployment
- Third-party credentials encrypted before they reach the database
Data Handling & Retention
Personal data does not sit around indefinitely. A scheduled sweep enforces per-data-class retention windows, and every inbound webhook is signature-verified.
- Automated daily PII retention sweeps with configurable windows
- Raw screening reports minimized after a short window — only the recommendation is kept
- Webhook signature verification that fails closed (auth, payments, screening, e-sign)
- GDPR-aware handling with right-to-deletion support
Have specific security requirements?
We're happy to walk through our security posture, our data handling, or answer detailed compliance questions.