Compliance
Safe by default
Security First
Project-scoped access, passwordless sign-in with optional passkeys, and the same activity policies on desktop, field, and API.
Security here is access control and integrity, not a brochure list. Sign-in is SuperTokens passwordless — email or phone OTP and magic links — plus WebAuthn passkeys. Sessions carry identity. Project membership and permission bits load from the database, not from a stuffed JWT.
Raise, execute, define, manage users, and manage notable events are separate bits. Witness and sign-off rules live in the shared domain package so field, desktop offline replay, and the API agree. Evidence uploads use hashed files and bound presigned URLs. We do not claim TOTP MFA, client-side encryption at rest, or a named compliance badge we have not earned.
Who can raise, who can witness, who can sign
A completions system that lets anyone sign anyone’s ITR is not secure. Permissions and activity policies are the product: raise gates, witness separation, and sign-off that waits for evidence. That is the security story that matters on site.
What it does
- ✓Passwordless sign-in with email or phone OTP and magic links
- ✓Optional WebAuthn passkeys on the same login
- ✓Project-scoped permission bits enforced in the UI and the API
- ✓Assignee-based activity policies, with execute and raise overrides
- ✓Witness rules that stop the assignee witnessing their own work unless execute applies
- ✓Sign-off blocked until required steps are complete and evidence uploads are confirmed
- ✓TLS for production database connections
- ✓SHA-256 hashes on evidence and document revisions
- ✓Presigned evidence uploads bound to content type and size
- ✓Tiered rate limiting on auth, API, and sync endpoints
Highlights
- • Permissions are server-enforced, not UI-only
- • Same policy module on API, desktop offline, and field
- • Identity in the token; grants in the database
- • No invented SOC 2 or ISO 27001 claim on this page
Demo
Demo video coming soon
See the rest of the platform, or talk to us about a demo.