Updated 2026-08-01
Security posture
How access is controlled, what is logged, and how incidents are handled.
Tenant separation
Every record carries the organization it belongs to. Access rules are enforced in the database rather than in application code, and are verified against a hostile test: a signed-in account from one organization attempting to read another's records receives nothing.
Client accounts are scoped further, to their own client record only. Subcontractor accounts are scoped to a single engagement.
Authentication
Email sign-in links and Google sign-in. No anonymous accounts. Roles are held in a separate membership table, never on a user-editable profile, so a user cannot raise their own privileges.
Audit trail
Record changes, decisions, assistant exchanges and exports are written to an append-only log. No role can edit or delete an entry, including an owner.
The assistant
The assistant has read access and no authority. It cannot record an approval, cannot run deliverables through generative tools, and explains only documents this organization authored and flagged as explainable.
Incidents
Security incidents affecting your records are reported to you within the notice period stated in your agreement, seventy-two hours by default, with the facts as known and the action being taken.
Accessibility
Screens are built to WCAG 2.1 AA: keyboard reachable, visible focus, contrast at or above AA, and status carried by label text and shape rather than colour alone.