— Accounts & security
Every build ships with real identity and real protection: who gets in, what they can see, and a database that enforces the rules itself. (Row-level security = the database checks permission on every single row, not just the app screen in front of it.)
01 — What this includes
These aren't add-ons you buy later. They're the layer everything else on your platform is built on.
Real accounts for everyone who touches the system: customers, owners, staff, each with their own secure login, never one shared password.
Verify a person with a fresh numeric code, so access never rests on a password alone.
Owner, staff, contractor: each role sees exactly what it should and nothing it shouldn't, decided by the system, not by trust.
The database itself checks permission on every row, so a customer can never load another customer's records, even if someone tampers with the request.
One business, one database. Your data sits alone, isolated from every other business we build for.
Logins, domains, and API keys stored under AES-256 encryption, readable only by your project's staff and recorded whenever they're accessed.
02 — How it's engineered
Security here isn't a checkbox on the front-end. It's enforced at the layer that actually holds your data.
RLS is a rule that lives in the database, not the app: it decides row by row who may read or change a record, so security holds even if a bug slips past the screen.
In transit, data moves over the same encrypted connection your bank uses (TLS); at rest, it's stored encrypted (AES-256). Never in the clear, either way.
An append-only record of the actions that matter (who did what, when) that can be added to but never quietly edited, so there's always an honest history.
03 — Questions
No. One business, one database, single-tenant by default. Your records are isolated from every other business we build for, not sharing a table with them.
The database enforces its own rules. Even if someone gets past the front-end, row-level security and server-side checks refuse to hand over data they're not allowed to see.