SECURITY

Implemented controls, without certification claims.

The platform uses ChatGPT identity for sessions and checks membership, company and role server-side on every access.

Tenant isolation

Every record, document, task, approval and event query is scoped by tenant membership.

Viewer, operating and sensitive finance roles are enforced on the server.

Files use private object storage, safe names, type/size limits and authorised download.

Mutations create events; posted books are reversed instead of silently edited.

Tokens are shown once, stored as hashes, scoped, expirable and revocable.

Money, filing, signature and provider actions remain gated and inactive without dependencies.

This describes implemented software controls; it is not a security or compliance certification or a guarantee against all risk.