Security by default

• Tenant isolation: every record carries its organisation; queries go through tenant-scoped managers; cross-tenant access is tested.
• Access control: business roles (owner, admin, analyst, reviewer, developer, billing) and eight platform roles enforced server-side on every endpoint.
• MFA: TOTP with QR enrolment and recovery codes, required for privileged platform roles; login lockout and session revocation.
• Secrets: provider credentials encrypted at rest and never returned by any API; API keys hashed with rotation and grace periods.
• Transport & browser: HTTPS, strict Content-Security-Policy, CSRF protection, same-origin cookies, rate limits.
• Payments: Razorpay checkout and webhook signatures verified; idempotent processing; reconciliation.
• Audit: hash-chained, append-only audit log of privileged actions with an integrity check.
• Media: zero raw-media retention by architecture; automated tests assert no file or binary fields exist.

Responsible disclosure

Report vulnerabilities to contact@etiquette.ltd. Please allow us reasonable time to fix before publishing.