Security & privacy
Private partnership data requires server-side authorization, careful file handling, and minimization — not convenience storage of sensitive fields.
Server-side permissions, RLS where appropriate, private file storage with signed URLs, secure session handling, rate limiting, CSP and security headers, upload validation, and webhook signature checks.
Audit logs, consent records, privacy controls, deletion and export workflows, and admin MFA-ready design are part of the security baseline.
Migration-ready policies: 6 · Planned: 0. RLS is defense in depth. Apply supabase/migrations/20260725_rls_go_live.sql in Supabase before multi-tenant traffic. Server-side permissions remain authoritative.
Apply SQL: supabase/migrations/20260725_rls_go_live.sql. Full checklist: Admin (MFA-ready) and docs/security/RLS_REVIEW.md.
Responses include CSP and hardening headers (Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, Strict-Transport-Security, Cache-Control).
Verification status: ok · never-store policies: 3.
Sensitive data is not stored because it “might be useful.” Capital identity and exact liquidity remain private until mutual workflow allows disclosure. Privacy export: POST /api/privacy/export.
Security protects data. Compliance boundaries define what the product is allowed to claim.