Isolation in the database
Every row carries the organization that owns it, and the database refuses to return a row belonging to anyone else — enforced by policy, not by application code remembering a filter.
Security
Access is decided by the database, not by the screen that happens to be rendering. That distinction is the difference between a control and a courtesy.
01How isolation works
Enforced where it cannot be bypassed.
A filter in the browser is a courtesy. A policy on the table is a control — it holds regardless of which client asked.
Roles decide reach
Fifteen roles, and your own admin decides which pages each can open. Granting a page never grants a write; that is a separate rule on the table itself.
Site staff see their own sites
A site engineer reads the projects they are assigned to and no others — enforced in the database, so it holds whether the request came from the app or anywhere else.
Outsiders never get an account
Contractors and architects come in on an opaque link with a one-time code, an expiry and a lockout. No seat, no password, no standing access.
Bidders never see your rates
The tender surface reads through an explicit column whitelist that does not name your own numbers, so a contractor cannot request what they are not meant to see.
An audit trail you cannot rewrite
Allocation history and order events are append-only. A log that can be edited from inside the system it audits is not a log.
02In practice
The rules that stop the obvious mistakes.
Approval means a second person
The predicate that lets somebody raise an order is deliberately not the one that lets them approve it, so an approval step cannot be a formality.
Privilege cannot be self-granted
Role changes are refused by a database trigger unless made by someone senior enough — including for the person making the change.
New accounts start at the bottom
Sign-up metadata is never trusted for a role. Everyone lands on the lowest privilege and is raised deliberately.
Secrets stay server-side
The browser never holds a key that can read the database. Every privileged call runs on the server.
Strict transport and headers
HSTS, no framing, no referrers leaking, a content policy with no external script origins.
Your data is exportable
In full, whenever you ask. Retention is your decision, not a lever we hold.
For an enterprise review we will walk your team through the access model line by line, including the parts that are deliberately restrictive.
Bring your security team.
We would rather answer the hard questions before you buy than after.
Build smarter.Execute faster.Deliver better.