Security

Tenant isolation, enforced in code

Every organization- and workspace-scoped API route requires a permission or role guard — verified directly against the route table, not assumed. Data queries are scoped by organization and workspace ID at the query layer, not filtered client-side.

Role-based access control

Access follows role → permission → scope → resource, not a fixed list of hardcoded roles. Owners and Admins manage who can see and do what, down to individual modules.

Authentication & sessions

Email/password sign-in with email-code verification, server-managed sessions, and TOTP-based two-factor authentication are all live today, built on Better Auth.

Audit logging

Privileged actions — role changes, permission changes, security-relevant settings — are written to an append-only audit log, visible to Owners and Admins in the Security Center.

API keys

Keys are hashed before storage and shown in full exactly once, at creation. We can't retrieve a lost key for you — we don't have it either.

Transport & storage

All traffic runs over HTTPS. Application data lives in Supabase Postgres and Storage, encrypted at rest by the underlying infrastructure.

Rate limiting & request hardening

API requests are throttled per organization, and standard security response headers are applied platform-wide.