Tenant isolation
Every agency is isolated in the database itself. Every table carries your agency ID and every query is checked by row-level security. No policy can open another agency's rows.
Server functions
Our server functions never use an unrestricted key. Each query is scoped to your agency, and a check runs on every build to catch any function that tries otherwise.
Client access
Client users see only their own company, and only the brands and projects they're given. In a company tree, access never flows up or sideways.
Authentication
Email and password, magic links and TOTP two-factor. Once an admin enrolls, admin access requires 2FA.
Secrets
Your integration keys live in an encrypted vault, never in our code. They are read only to make your agency's own calls and never sent to the browser.
Webhooks
Signed and idempotent. Signatures are verified, and the same event is never processed twice.
Files
Signed links for every upload and download. Files go to Cloudflare R2 by default, and the Scale plan lets you bring your own S3-compatible storage.
Browser protections
A Content Security Policy that forbids inline scripts, plus security headers on every response.
Plan limits
Quotas are enforced by the database. Going over a limit stops new records only. Existing data is never locked.
Bot protection on booking pages (planned)
Public booking pages don't have bot protection yet. Cloudflare Turnstile is on our list.
Backups (planned)
Production hosting will run with point-in-time recovery and a copy kept at a separate provider. We'll publish the details when production hosting goes live.
How we build
Secret scanning, schema audits and end-to-end smoke tests on every change. Every database migration ships with its own test, a schema audit checks the isolation rules on every new table, and a build check blocks server functions that bypass agency scoping.
