Private customer workspaces
The server checks the signed-in account before reading or changing customer records. A customer cannot request another customer’s workspace.
FORTESAN / SECURITY
Access with intention.
Controlled staff access
Public registration creates customer accounts only. Initial staff setup requires a private, one-time key. Staff-only notes are not included in customer responses.
Account protections
Passwords are stored as bcrypt hashes. Data access is checked by database row-level security policies. Input constraints protect stored records, and Supabase rate limits authentication attempts.
Current limits
Bank connections, SSO, and multifactor authentication are not enabled. Public email confirmations and password recovery await a configured email sender. No independent certification or completed external security audit is claimed.