One section we can actually stand behind today, rather than a resource centre with empty shelves. Everything below is implemented in the shipped product and described in enough detail for you to ask us a hard question about it.
Each control below says what it protects and how it is implemented, because “enterprise-grade security” tells an evaluator nothing.
Reads and writes are scoped by company. A dedicated regression suite injects unscoped queries and asserts they are caught, so isolation is exercised on every commit rather than assumed.
Unique indexes carry the rules the application also checks, so two requests arriving at the same moment cannot both win. Losing that race returns the same friendly refusal a single caller would have received.
TOTP, compatible with standard authenticator apps, with single-use recovery codes stored hashed. The challenge is exchangeable only at the verification endpoint and is rejected everywhere else.
Each token carries a session id, so signing in elsewhere ends the previous session. Failed attempts are counted and lock the account; authentication routes are rate limited more strictly than the rest of the API.
Length and composition requirements are enforced server-side and configurable per workspace, with platform defaults for anyone who has not changed them.
Sign-ins, failures, lockouts and settings changes are recorded as security events against the workspace, readable by an administrator.
Credentials are encrypted before storage and every stored value carries the key version it was encrypted with, so keys can be rotated without losing what came before. No HTTP route returns a decrypted credential — a test enforces that.
Admin, agent, sub-agent, billing, accounting and HR are checked on the route, not in the interface. Hiding a button is a courtesy; the refusal happens on the server.
Documentation, task guides and a public changelog belong here too. They are not written yet, so they are not listed yet — a link to an empty page is worse than no link. They will appear on this page when there is something behind them.