Data flow and security
Architecture
The hosted-alpha design uses a Next.js application, an EU-region Supabase project for PostgreSQL, passwordless authentication and private storage, and a reviewed transactional-mail provider. Production approval requires isolated production, staging, preview, and local credentials; production customer data must never be copied to a lower environment.
Access boundary
Database row-level security is the mandatory tenant boundary. Verified domains route requests but never grant access. Owners approve members, and privileged platform administration is separate from institution workspaces.
Public and background paths
Public inquiry endpoints use validation, a honeypot, and keyed rate limiting. Uploads use private storage, file-type and size checks, and workspace-prefixed paths. Background email and extraction work uses durable records, bounded attempts, idempotency, and generic logs.
Recovery and assurance
The initial objective is restoration within one business day with no more than 24 hours of data loss. These are release targets, not current hosted evidence. Production release requires migration and isolation tests, a timed hosted backup/restore exercise, accessibility checks, secret/dependency scanning, and independent review of authentication, tenancy, admin paths, public endpoints, uploads, exports, and jobs.