Tenant isolation and data security

Row-level isolation

Every business-scoped table carries an organization id and is protected by row-level security. Policies check membership through a security-definer function, so a query can only ever return rows for businesses the caller belongs to — there is no application-level filter to forget.

Concurrency and versioning

Records that multiple people edit carry a version column. Updates send the version they read; if someone else saved first, the write is rejected and you are asked to reload. Hotel bookings and stock movements use atomic database routines so two clerks cannot sell the same room or the last unit of stock.

Audit trail

Privileged actions — role changes, module toggles, exports, handovers, closures — are appended to an immutable audit log with actor, timestamp and payload. Tenant lifecycle events are also copied to a retained log that survives permanent deletion, which is what compliance reviews ask for.

Your responsibilities

• Use unique passwords and remove leavers from Team the same day
• Grant Viewer instead of Admin to external accountants
• Export before you close a business — purges are irreversible