Security enforced beneath the interface

Every application table is protected by enabled and forced Row Level Security. The application connects through a non-bypass role and pins user and company context inside each transaction.

Routes do not trust a visible button. Authentication, active membership, role capability, entitlement, input schema, tenant identity, and rate limits are checked again before state changes.

Audit rows and time-event history resist update and deletion. Corrections retain lineage, while exports use formula-safe serialization and deterministic integrity manifests.

API keys and station credentials are hashed. Webhook secrets are AES-256-GCM wrapped with tenant-and-endpoint-bound authenticated data and shown only at issuance or rotation.

Webhook destinations are HTTPS-only, reject private or reserved addresses, resolve again at send time, pin the validated socket, refuse redirects, sign the exact body, and never retain receiver output.