One company's data must never be visible to another

Infrastructure and network

The application, the database (PostgreSQL), cache and file storage run on a Kubernetes cluster we operate in a data center in Germany. The database and file storage are reachable only from inside the cluster; no database port is exposed to the internet. Administrative access uses a VPN and key-based SSH.

Cloudflare is the only door to the outside world. DNS, content delivery, DDoS protection and the web application firewall run at that layer. We do not publish the origin IP address of our servers in public DNS.

Tenant isolation in more than one layer

Separation between companies is enforced mainly in the application layer, by the company filter on every query, together with role-based permissions. Row-level security in the database is an additional layer against anonymous access.

1. Database: Row-level security (RLS) is enabled on tables; personal data cannot be read with anonymous access.
2. Application: Every API endpoint first validates the session and permission, then resolves the active company. Queries are filtered by that company; sending another company’s record ID returns nothing.
3. Permission model: Role-based access control works per module and per action. For example, a sales rep can be allowed to read only their own customers in the CRM while having no access to payroll at all.

Shareable links (proposals, the reconciliation approval page, customer statements) use unguessable random tokens, expire, and show only the data that document needs.

Encryption

• In transit: TLS between the browser and the platform, and on calls from the platform to services such as email, SMS and e-signature.
• Integration credentials: Account details each company connects are encrypted with AES-256-GCM. Decryption happens only on the server during the relevant operation; the decrypted value never appears in a response.

Access control and sessions

Panel sign-in uses a one-time verification code. Sessions are managed with secure cookies. The company owner grants and revokes member permissions per module from the team page; a departing employee’s access is closed in one step.

Audit trail and monitoring

Key business records keep a history: status changes on sales services, proposal edits, reconciliation send and approval events, and every action taken by AI assistants. Application errors are tracked with an error monitoring service, and infrastructure health with disk, memory and service alerts.

Secure development

Code changes are kept in version control, pass automated tests and are deployed as container images. Secrets live in in-cluster secret stores, not in the repository. Company scoping and a permission check are mandatory checklist items for every new API endpoint. We accept vulnerability reports through the process on the responsible disclosure page.