Approval data is sensitive. Here’s how we treat it.

Workspace data is stored in a managed Postgres database (Supabase) with file attachments in Cloudflare R2 object storage. Backups and encryption at rest are handled by those platforms; all traffic is encrypted in transit with TLS.

Every table that holds workspace data is protected by row-level security: queries run as the signed-in member and can only return rows from workspaces they belong to. Isolation is enforced by the database, not just the application code.

Three roles — Owner, Admin, Member — bound what anyone can do. Members submit and review; only Owners and Admins publish templates, configure workflows, manage integrations, or invite people. Restricted teams limit template visibility further. External submitters (intake links, email intake) see a single form, never the workspace.

Every request carries an append-only history: submissions, routing, decisions, comments, and reassignments are timestamped and tied to the person (or agent) who acted. Workspace-level administrative actions are logged separately. When a request closes, an AI-written decision record summarizes the audit trail — derived from it, never replacing it.

Outbound event webhooks are HMAC-SHA256 signed with a timestamp so your receivers can verify origin and reject replays. Integration webhook URLs are validated against private-network targets, and every integration is scoped to the workspace that connected it.

AI features run through a provider-neutral service; workspaces can bring their own API keys, which are encrypted at rest and never shown again after entry (only the last four characters). Prompts are grounded in your recorded request data — summaries and decision records cite what was actually submitted and decided.

Workspace Owners can export everything — teams, templates, requests with answers, comments, audit history, decision records, and members — as a single file, any time, from workspace settings. No lock-in, no support ticket.

Authentication is handled by Supabase Auth with Google and Microsoft single sign-on alongside email. Sessions are cookie-based and server-verified on every API call.