Product/ Security & Trust
Firm-isolated, audited, classification-aware.
Guarantees enforced in the database and at the commit boundary, not in a policy document.
Join waitlist
Isolated
Row-level security under a role that cannot bypass it. Unset scope returns zero rows.
Audited
Audit rows write in the same transaction; a tripwire rolls back anything unaudited.
Classification-aware
MNPI is excluded from retrieval by default and redacted on export by audience tier.
Most vendors answer a security questionnaire. These controls are enforced by the database and the runtime, so they hold whether or not anyone is watching.
Tenant isolation, defense-in-depth
Every query carries explicit firm filters in application code, and beneath them Postgres row-level security under a role that cannot bypass it, keyed by a transaction-local firm setting. Cross-firm nesting throws. An unset scope fails safe — to zero rows, not to everything. A repository seam with a CI ratchet keeps the pattern from eroding.
C# firm filters + RLS (no-BYPASSRLS role) + transaction-local firm GUC. Unset scope → zero rows.
Audit everything, enforced at runtime
Every business mutation writes an audit row in the same transaction as the change itself. A commit-boundary tripwire rolls back any firm-data mutation that arrives without one. Auditing is not a convention here; it is a constraint.
Same-transaction audit rows; commit-boundary tripwire rolls back unaudited mutations.
ABAC over RBAC
Access decisions combine org role, space membership and MNPI clearance — with deny overriding allow. A title alone never grants access to a deal.
Deny-overrides evaluation across role, membership, clearance.
The MNPI lifecycle
Material non-public information is classified at ingest and excluded from retrieval by default. Disclosure is recorded and starts a 30-day auto-declassify clock; manual declassification is confirmation-gated. Exports redact by audience tier, and the redaction manifest lands in the audit trail.
Classify at ingest → retrieval-exclude → disclosure clock (30d) → gated declassify → tiered export redaction.
Chinese walls
Deal-room isolation is enforced where it matters: in retrieval. What you can retrieve is scoped by your space memberships, and meeting context is resolved per viewer — a shared brief never carries one person's private context to another.
Space-scoped retrieval; per-viewer meeting context.
Sessions & cryptography
Sign-in through WorkOS AuthKit with server-side Redis sessions and sealed cookies. Secrets live in per-environment key vaults. Connector credentials are sealed with AES-256-GCM, webhooks are HMAC-verified, and GDPR hard-delete sweeps actually delete.
WorkOS AuthKit · Redis sessions · sealed cookies · per-env Key Vaults · AES-256-GCM · HMAC webhooks · GDPR sweeps.