Security

Delegation requires a smaller key, not a master key.

Tenant isolation

Every customer-owned row carries organization_id. Row-level security restricts reads and writes to membership. Operators see assigned work; they do not browse another tenant’s files.

Authorization is not the proxy

src/proxy.ts only routes unauthenticated visitors. Session, role, and RLS are checked again on the server for every read and mutation.

Least privilege

Integrations request only the scopes a workstream needs. Privileged Supabase keys never ship to the browser.

Bounded authority

Sensitive execution cannot enter in-progress without an approved approval | in application code and in a database trigger.

Audit trail

Logins, request changes, approvals, assignments, exports, integration access, and AI actions are written to audit_events.

What we will not do

We do not silently send, buy, publish, commit, transfer funds, or change access. We do not take custody of customer funds or practice regulated professions.