Tenant isolation
Every query carries a tenant scope and the data layer rejects an unscoped read or write rather than trusting callers to filter. This is enforced below the API, so it holds for every endpoint including exports and the portal.
Trust · security
Not a badge wall. What the controls actually are, where they are enforced, what is tested and how often, and the two architectural decisions a reviewer should push on.
SOC 2 report under NDA, DPA, sub-processors, penetration test summary, and architecture overview.
Controls
Every query carries a tenant scope and the data layer rejects an unscoped read or write rather than trusting callers to filter. This is enforced below the API, so it holds for every endpoint including exports and the portal.
TLS 1.3 in transit. AES-256 at rest across databases, object storage, and backups. Keys managed in a dedicated KMS with rotation and separated duties.
Role-based permissions with least privilege, SSO via SAML or OIDC and SCIM provisioning on Enterprise, and mandatory MFA for administrative roles.
Human actions, agent actions, and privileged administrative changes in one append-only schema with content hashes, exportable to your SIEM.
Continuous backup with point-in-time recovery, five-minute RPO and four-hour RTO, restore tested quarterly with results in the security pack.
Peer review on every change, dependency and secret scanning in CI, staged environments with no production data, and annual third-party penetration testing.
Most security questionnaires spend their length on controls that are table stakes and skip the two architectural decisions that actually determine blast radius. If you only have time for two questions, ask these.
The common answer is "in the application layer" — every query includes a tenant filter because the developers remembered to add one. That works until somebody writes an endpoint that forgets, which is a class of bug that has produced most of the cross-tenant incidents in this industry.
Ours is enforced in the data access layer: a query without a tenant scope is rejected rather than executed, and there is no code path that can express one. Row-level security in Postgres sits underneath that as defence in depth. The practical test — which you should apply to any vendor — is whether a developer could write an unscoped query and have it run. Here the answer is no, because it fails at the layer below them.
This is the question unique to an AI-native system and the one most security reviews do not yet ask. Agents in this platform operate under an explicit authority model with five levels, enforced as middleware by a deterministic policy engine the agent cannot address or argue with.
Four actions are absent from the permission model entirely rather than defaulted off: releasing funds, closing or reopening a period, writing to the general ledger directly, and modifying permissions. There is no configuration that produces them, which means the blast radius of a compromised or misbehaving agent is bounded by construction rather than by policy.
We operate a disclosure programme and will not pursue researchers acting in good faith. Report through contact with "security" in the subject; we acknowledge within one business day and publish an advisory once a fix is deployed.
Questions
The pack answers most questionnaires directly, and we will take questions from your security team without a salesperson on the call.