Security

Every workspace is isolated at the database level. Row-level security policies prevent cross-tenant reads and writes. A user in one workspace cannot access another workspace's records through any UI, API, or MCP path.

Human-only actions — confirming notice deadlines, approving final decisions, verifying dates — are enforced in the service layer and database policies. Neither the browser, an MCP-connected agent, nor a direct API call can bypass these checks.

Workspace data is stored in a managed Postgres database (Supabase) with encrypted connections. Service-role keys never reach the browser. All secrets and external API calls are handled server-side.

Every status-changing action records the actor, timestamp, previous and new values, and provenance (web, MCP, system, or email link). No silent destructive writes occur.