Security

Only statements backed by the CRM code and tests (apps/crm) appear here. Items marked TODO are not yet claims.

Tenant isolation

The workspace is chosen only by your credential. A tenant id in a request body cannot pick a workspace.
Postgres row-level security applies to every table with a tenant id, under an app role that cannot bypass or disable it.
Records can't reference another workspace's records.
A request for another workspace's record looks the same as a missing record.
Usage records and the audit log are separate per workspace.
Automated tests, including randomized cross-tenant operation sequences, check that no data crosses workspaces.

API keys are stored only as hashes and carry scopes (crm:read, crm:write, admin).
OAuth 2.0 client credentials for server-to-server use.
OAuth 2.1 with PKCE for MCP clients, with refresh-token rotation and discovery metadata.
A revoked API key fails on the next request; revoking an OAuth client ends its live tokens immediately.

Sensitive fields are encrypted at the field level with AES-GCM, bound to the workspace, with key rotation support.
The audit log is append-only.

TODO: hosting region and provider statement (align with Privacy/Subprocessors drafts).
TODO: encryption in transit and at rest for the platform beyond field-level encryption.
TODO: penetration test, SOC 2 or other certifications (none exist today).
TODO: incident response and breach notification commitments.
TODO: vulnerability disclosure policy and security@ address.

Report a security concern: hello@richbee.ai (TODO: dedicated security address).