Security & data
Clear boundaries. Honest status.
This MVP has implemented access controls. Production assurances need evidence from the deployed service.
Private business workspaces
Account API requests verify the signed-in Supabase user on the server. Tenant identity is resolved from the user record, never supplied by the browser. Mutations scope every record to that business.
Database access
The schema enables row-level security on every table. Public Data API access has no policies granting access. The server uses a privileged database connection and enforces tenant boundaries itself.
Demo isolation
The demo contains fictional examples and uses versioned browser storage. It does not contact customers, send messages or access live account data. Avoid entering personal or sensitive information in the demo.
Before live phone cover
The pilot still needs verified provider setup, retention and deletion procedures, regional hosting confirmation, abuse controls and end-to-end call testing. No compliance certification, UK residency or uptime guarantee is claimed here.