Security and data isolation

Websites, requests, reports, recommendations, files and conversations all carry the organisation they belong to. There is no shared pool.

Row-level security policies decide what each signed-in account can read and write. Hiding a link in the interface is never the control; the database refuses the query.

Roles are never trusted from the browser. Anything privileged is authorised server-side against the signed-in session.

Uploads are stored under organisation-specific paths and served through access-checked links, not public URLs.

The public product demonstration runs against a dedicated demo tenant. It cannot read or write real customer data.

If you believe you have found a security issue, contact us directly. We will acknowledge and investigate.