Security Overview

Data Security

Transport and storage protections are reviewed service by service; no fixed algorithm is claimed for every data path without deployment evidence.

Cloud Infrastructure

Customer data is hosted on managed Google Cloud and Firebase services with service-specific region configuration.

Access Controls

Layered access controls are designed to restrict users to authorized data and actions; backend checks and Security Rules are the final enforcement points.

• Role-Based Access Control (RBAC)

  Predefined roles (Admin, Sales, Distribution, Customer) with configurable module-level permissions

• Multi-Factor Authentication (MFA)

  Firebase Authentication with support for email/password, phone, and third-party identity providers

• Session Management

  Automatic session expiry, per-user rate limiting, and Firebase App Check support where enforcement is enabled for the deployment.

Audit Logging

Supported security-sensitive mutations emit audit events for operational review; workflow coverage must be verified before production claims are made.

• Audit Event History

  Audited workflows record create, update, delete, or status metadata according to their implemented event contract.

• GoBD-oriented review support

  Supports GoBD-oriented digital record-keeping; company-specific requirements should be reviewed.

• Field-Level Diffs

  Where supported, audit events capture changed fields, actor context, and timestamps for review.

Data Retention

Configurable data retention policies that support legal review while respecting your data minimization preferences.

Backup and Recovery

Production recovery controls are treated as operational evidence, not a marketing promise.

• Scheduled Firestore Exports

  The production preflight requires scheduled Firestore export configuration with a non-default private backup bucket before production audit can pass.

• Restore Drill Required

  A backup is not treated as launch-ready until a restore into a non-production environment is rehearsed and recorded.

• Evidence-Based RPO/RTO

  Customer-specific RPO/RTO commitments are only stated in signed agreements after deployment, first-export, and restore evidence exist.

Security Testing

Security assurance combines source review, automated checks, and explicit disclosure of testing work that is still pending.

• Code and Rule Review

  Tenant isolation, callable authorization, Firestore rules, Storage rules, and public-copy claim guards are reviewed in repo before release.

• Dependency and Secret Checks

  Web and Functions dependency baselines, production-config preflights, and secret-hygiene scans are part of the release checklist.

• External Penetration Test

  No external penetration-test report is claimed yet; it remains a pre-enterprise/customer-request item until scheduled and evidenced.

Incident Response

We maintain a documented incident-response process to detect, contain, assess, and recover from security incidents.

Compliance Roadmap

A roadmap of security controls and independent review targets. No certification is claimed unless the status is explicitly marked active.