Security

Every table holding company data is protected by row-level security in the database itself, keyed to the authenticated user's company membership. Isolation therefore does not depend on the application remembering to filter: a query that forgets a company filter still returns nothing from another tenant.

Three roles: master (full control, including imports, approvals and user management), finance (company-wide read, plus reporting and analysis), and project (limited to explicitly granted projects). Access changes are recorded in the audit trail.

Imported figures are immutable: corrections are recorded as adjustments with an approval, never as an edit over the original. Publication is atomic and enforced inside the database, which also re-checks the quality gates — a client cannot publish by calling the API directly. Closed periods can be locked, and a locked period rejects further changes at the database level.

Every published figure carries its provenance: the file, its hash, the sheet, the row, the column, the header and the account mapping applied.

Authentication is handled by Supabase Auth; passwords are hashed and never visible to us or stored by the application. Sessions are cookie-based and scoped to the browser.

Planned: multi-factor authentication and SSO (SAML/OIDC) for enterprise plans. Not yet available.

Application logs are structured and redacted at source: credentials, tokens and personal email addresses are masked before a line is written, so operational logs cannot become a data leak. Failures in imports, webhooks, provisioning and email are captured as incidents, and the ones that risk customer impact are escalated rather than filed.

Imports, publications, adjustments, approvals, period locks, access changes, provisioning and forecast approvals are all recorded with the actor, the time and the relevant identifiers. Audit records are written with a privileged server credential and cannot be created or altered by ordinary users — including a company's own master.

Managed daily backups are provided by our database platform. A documented restore procedure and a rehearsed recovery test are in progress and will be described here once completed, with the measured recovery objectives rather than aspirational ones.

Write to security@kestrant.com with enough detail to reproduce the issue. We will acknowledge within two business days, keep you updated, and will not pursue action against good-faith research that avoids accessing other customers' data and does not degrade the service.