01
Isolation
Your data lives in your own instance and database, and inside it every brand is a hard boundary.
- One application instance and one database per company.
- Brand scope applied to screens, APIs, background jobs, exports, files and webhooks.
- Records from another brand resolve as not found, even by direct link.
- Every route, job, export and webhook is covered by cross-brand denial tests.
02
Access
People get exactly the access their role and brand membership allow, and nothing by default.
- Invite-only accounts. There is no public sign-up.
- Two-factor authentication enforceable by policy, plus passkeys.
- Session overview with remote sign-out, and re-authentication for sensitive actions.
- Roles and permissions configured per instance, with module-declared permissions.
03
Secrets and files
Credentials and files are private unless something is explicitly made public.
- Provider keys stored as vault references, never shown or returned by an API.
- Files private by default, with unguessable names and signed, expiring links.
- Public images explicitly flagged as public assets.
- API tokens hashed at rest, scoped and tracked by last use.
04
Integrations
Everything that enters or leaves the system is verified, de-duplicated and bounded.
- Inbound webhooks verified by signature; unsigned requests are rejected.
- Every provider event applied exactly once, however often it arrives.
- Outbound requests restricted to allow-listed hosts over HTTPS, with private networks blocked.
- Signature comparisons in constant time.
05
Accountability
Important changes leave a trail, and risky actions can wait for a person.
- Audit records for subscription changes, sends, configuration and access.
- An approval inbox with reviewer notes and full history.
- Assistants propose; people approve anything that writes.
06
Reliable sending
The sending engine is designed so that failure modes are visible and bounded.
- Recipients claimed atomically, so scaling workers never causes double sends.
- Ambiguous provider responses held for an operator instead of retried blindly.
- Bounded retries with back-off, and per-brand rate limits honoured under load.
- Stuck work released by a sweeper and surfaced in the operator view.
- Load-tested with large audiences, concurrent campaigns and injected failures.