Tenant isolation
Every organisation’s data is protected by PostgreSQL row-level security, in addition to permission checks in every service.
Role-based access
Seven roles with company scopes, enforced in APIs, search, the assistant, exports, notifications and background jobs.
Separation of duties
Preparers can’t approve their own work. The assistant and automated jobs can never approve, close or sign.
Sessions and passwords
Passwords hashed with scrypt; random session tokens stored only as hashes in HttpOnly cookies.
Protected documents
Originals stored write-once with SHA-256 hashes, downloaded only as attachments; retention and legal hold supported.
Untrusted content
Uploaded content is treated as evidence, never as instructions. Embedded instructions are flagged.
Safe retrieval
Only public web addresses are fetched; private networks and cloud metadata endpoints are blocked.
Tamper-evident trail
Every significant action is hash-chained per organisation and can be verified by administrators.
Processing transparency
Administrators see where files are stored, whether OCR runs and which AI provider, if any, is used.