Access and isolation
Sessions, memberships, capabilities, entitlements and PostgreSQL Row Level Security protect organisation data.
Security
Security is a product capability, not a final checklist.
Tenant isolation, access control, validation, audit logging and secure integrations are designed from the data model onwards.
Secure boundaries
Forms, uploads and webhooks receive schema validation, rate limits, allowlists, signatures and idempotency.
Operational security
Monitoring, backups, restore tests, incident procedures and responsible disclosure are release requirements.