Identity and authorization
When production authentication is enabled, the server verifies Supabase Auth tokens and checks company membership and roles before tenant-data operations. Each deployment requires separate configuration verification.
SECURITY
Security is enforced at product boundaries.
This technical overview covers verified software controls. It is not a substitute for a penetration test, ISO 27001, SOC 2 or another certification.
Input and file protection
Upload size and type are bounded, filenames are normalized, HTML and PDF output is escaped, and downloads check company access.
Secrets and connectors
Connector credentials are encrypted before storage when a deployment key is configured correctly. Customer APIs do not return raw tokens.
Headers and audit
The application sets security, CORS and cache headers and records material security and lifecycle actions. Deployment controls require separate verification.
Report a potential vulnerability through the authenticated Brivixo support channel. Do not upload a working exploit or another customer's data.