Security,by default.

• +API keys — only a SHA-256 hash is stored. The plaintext key is returned once when the key is created or rotated.
• +Scheduled-export credentials — destination secrets are encrypted at the application layer with the configured encryption key.
• +Authentication — Clerk session tokens are verified by the API; API keys can be restricted by scope, expiry, rate, and source IP.

Every contact, company, tag, task, workflow, import, and export is scoped to its owning account. A separate superuser role is used for platform administration. Shared workspace roles and workspace-level SSO are not part of the current product.

• +Backend CI runs formatting, linting, type checks, migrations, live schema-drift checks, and the test suite against PostgreSQL and Redis.
• +Both web applications run formatting, linting, type checking, and production builds in CI.
• +Runtime dependencies are pinned in the Python and pnpm lockfiles.

The application exposes error reporting and operational telemetry hooks. A production incident runbook, named responders, and notification procedure are not versioned in this project and must be established before launch.

Incident notification obligations depend on the applicable law and executed customer agreements. The repository does not contain the operational runbook needed to verify a response-time promise.