Tenant isolation
Every record carries its organisation. The organisation is derived from the server-side session and never read from a request parameter, so a crafted identifier cannot reach another tenant.
Authorisation
Roles are enforced on the server for every read and every mutation. The interface hides what a role cannot do, but hiding is a convenience — the check that matters runs before the query.
Sessions
Sessions are server-side records. The cookie holds a random token, HttpOnly and SameSite, Secure in production; only a digest is stored, and changing a password invalidates every existing session.
Audit
Sign-in, role changes, threshold edits, alert acknowledgements and exports are recorded with actor, target and time. Secrets and request bodies are never written to the trail.
Edge boundary
The edge appliance initiates outbound connections only and sends anonymous metadata. The cloud cannot reach into the store network or pull a stream.
Vulnerability reporting
We accept security reports from researchers and customers. Disclosure details are published in SECURITY.md in the product repository.