Security and privacy
Tax confidentiality is the starting point of the design. The topics below describe how the product is built; the product is under development and has no independent audit result yet.
01Multi-tenant isolationEach office's data is held in its own tenant scope; queries do not run without a tenant identity.
02Row-level securityDatabase policies limit row access by role and assignment; an external accountant sees only the assigned request.
03Immutable recordsFindings, uploads and report versions are append-only; a correction is recorded as a new event.
04Write-once archiveSigned reports and manifests are intended to be held in write-once storage. The retention period will be stated once the legal requirement is verified.
05Platform access is metadata-onlySupport staff cannot see document content by default; only counts, statuses and timestamps.
06Two-step access recordDocument access needs a time-limited permission from the tenant; the request and every record accessed are logged separately.
Data location and backup infrastructure are not final yet. They will be shared in writing before any contract.