Security
Tenant-scoped, idempotent, and private by default.
Every sensitive action is authorized server-side, every upload uses a server-generated private key, and ambiguous sends are never retried automatically.
- Private, encrypted object storage with short-lived upload signatures.
- Company membership predicates on every invoice query.
- Signature-verified, idempotent Stripe and queue webhooks.
- Append-only credits and immutable invoice revisions.
- Provider keys never reach browser bundles or logs.