Security
Isolation between companies
Every record carries the company it belongs to, and every query is scoped by it. This is enforced at the data layer rather than in each screen, so a missing check in one page cannot leak another company data.
The permission gate
A screen without a gate does not exist here. Permission is checked after resolving the company and before touching the database, and a denial returns an explicit refusal, never an empty list. An empty result and a denied request must never look the same.
The inspector is a role with a door
The inspector documents and cannot approve. That is not a UI convention, it is a gate measured in its closed state: the test that guards it asserts the denial, not the success.
Transport and credentials
Everything travels over TLS. Card data is handled by the payment processor and never reaches our servers. The bank connection is read-only.
What is not built yet
Field evidence is not cryptographically sealed today. There is no content hash of the photograph and no chain of custody. It is the open gap in this market and we would rather name it here than let the word verified imply more than it does.
Reporting something
If you find a way to reach data that is not yours, write to us before writing about it anywhere else, and we will work the fix with you.