Built to pass the vendor review.

Walled off in the database, not in the app

Each customer is separated by row-level security policies in the database itself. Application code cannot forget to filter, because the database will not return another customer’s rows to it.

1. Isolation enforced by the database, on every query
2. Automated tests attempt cross-customer reads and fail the build if one succeeds
3. Each customer works on their own address
4. Records a customer has not switched on do not exist for them, rather than being hidden

A record that cannot be quietly edited

Every step, decision and change is written to an append-only, hash-chained trail. Each customer has their own chain, which verifies independently of anyone else’s.

1. Updates and deletions to the trail are refused by the database
2. One chain per customer, verifiable on its own
3. Changes to a process are recorded with before and after values
4. When our staff enter your workspace for support, that is written to your trail

Most of it is already answered

The twenty questions that appear in substantially every questionnaire are answered on one page, including the four where the honest answer is not yet. Send us your own form for anything it does not cover.