Security & Infrastructure

Enterprise Tenant Isolation, Encryption, and Guardrails

1. Multi-Tenant Row Level Security (RLS)

Every record stored in our PostgreSQL database has an explicit foreign key relationship to an organization. Database policies guarantee that tenant data is never commingled or visible across client boundaries.

2. Encryption in Transit and at Rest

All web traffic, API transactions, and webhook deliveries are encrypted using TLS 1.3 / HTTPS. Database volumes and backups are encrypted at rest using AES-256 standards.

3. Webhook Signature Verification

All webhook deliveries from Razorpay and Meta WhatsApp Cloud API are verified against cryptographic HMAC SHA-256 signatures before processing.

4. Prompt Injection & Tool Whitelisting

AI model outputs are bounded and strictly whitelisted. Models cannot run raw SQL commands, shell scripts, or arbitrary network requests.