Security Overview
Security Overview
A description of implemented security boundaries, without certification claims.- Version
- 2026-08-24
- Effective
- Last updated
1. Tenant isolation
Business data is scoped to an organisation. Database row-level security, tenant-scoped foreign keys and server-side checks are intended to prevent access across organisations. Privileged workflows use narrow, audited database functions rather than browser-provided tenant identifiers.
2. Authentication and access
Sessions are maintained with secure cookies in production. Business access is separately gated by membership, account status, payment/manual access state and suspension. Employee permissions are narrower than owner access. Platform-administrator controls are separate, audited and limited to support and service-administration workflows rather than ordinary workspace ownership.
3. Secrets and integrations
OpenAI and integration credentials are handled server-side. Telegram bot credentials use encrypted server-side storage and verified webhook secrets. Requests are rate limited and integration/webhook paths are designed to reject malformed or replayed input.
4. Reporting
Use the security category of the HexSales contact form to report a suspected vulnerability. The request is stored in a restricted operational queue. Do not include passwords, tokens, private keys, live exploit payloads or unnecessary personal data.