Where the data sits, who can see it and what leaves a trace. What follows is not a design goal but behaviour that works today and is held in place by automated tests.
Organisations are not kept apart by a filter in the queries alone; the database enforces it row by row, and the application connects with a role that cannot step around it. A filter forgotten in code therefore leaks nothing.
Which organisation's data is being read follows from the address of the request; an organisation named in a request body or in user input is accepted nowhere.
The context one request leaves behind never reaches the next, and every cache key carries an organisation prefix. Both are held in place by their own integration tests.
Passwords are stored with Argon2id; neither plain text nor a weak digest can reach the database. Users join by invitation, and no account exists without a password.
Sign-in can be bound to a second step through an authenticator app, with backup codes against losing access. Repeated failed attempts lock the account.
One person can reach several organisations and hold different rights in each. Each organisation defines its own role-to-permission mapping; even notification recipients are chosen by permission rather than by role. An administrator can end a user's open sessions.
The reporter's contact details are not shown on screen; revealing them is a separate step, and that reveal is written into the audit trail.
National identity numbers, telephone numbers, e-mail addresses, tokens and passwords never reach the logs unmasked. Debug logging does not stay on in production.
Records are never physically deleted; a deleted record drops out of the lists but its trace remains in the audit trail. The organisation chooses the retention period, and six months before it ends several administrators are reminded.
An attachment is first stored unreachable, scanned in the background, and opened only if it comes back clean. An unscanned file is never treated as clean.
A file's real type is read from its content; a file whose extension disagrees is refused. Active content inside documents and encrypted archives whose contents cannot be inspected are not accepted.
If the scan finds something harmful the object is deleted from storage, and the record keeps the trace of it.
Passwords in an organisation's own settings — its mail server, for example — are held encrypted in the database; the encryption key comes from an environment variable and is never stored alongside the data.
Who, when, in which organisation, through which channel, the value before and after. The audit trail is not an optional feature but part of the write path.
A dedicated database and a choice of the country the data is held in are offered on the enterprise plan. The specifics are written into the contract.
We carry no ISO 27001 or comparable certification, and we do not write as though we did. The points above describe the product's own behaviour; what verifies them is an automated test suite, not an audit by a third party.
There are running tests for organisation separation, permission checks, file refusal and the audit trail, and we can walk through them in an evaluation call.