Security posture

Multi-tenant safety is a baseline, not a feature.

• Row-level security enforced on every tenant-owned table
• No anonymous access to operational data
• Role-based writes: platform owner, organization owner, purchasing admin, location manager, order creator, order approver, finance viewer
• Append-only audit events, purchase-order events, and price history
• Immutable pricing and item snapshots on submitted purchase orders
• Private file storage for spreadsheet imports — never public
• Integration connections store non-secret metadata only
• Secrets are held in managed platform secrets, never in the client bundle