BTL · Security
Production-grade security.
Granular RBAC down to the field. Isolated deployments per client. An audit trail on every admin and billing action.
01. Compliance
Status, not slogans.
Where each framework stands today, what's in flight, and what documents your security team can request.
Last reviewed · May 2026
02. Access controls
RBAC, granular.
Permissions cascade from organization to workspace to record to field. Least privilege enforced at every layer.
Per-collection roles
01Define read, write, and admin scopes on every collection. Roles cascade across nested resources without leaking access.
- Granular scope per collection
- Inheritance with overrides
- Custom role definitions
- API parity with UI controls
Per-field redaction
02Mask sensitive columns at the data layer. PII, financial fields, and credentials never reach the wrong viewer.
- Field-level encryption
- Conditional redaction
- Per-role visibility rules
- Server-enforced masking
03. Infrastructure
Isolated. Encrypted.
Tenant boundaries enforced at the data layer. Backed up with point-in-time recovery.
Tenant-isolated by default
Every customer's data lives in a logically isolated namespace. No cross-tenant queries are possible at the data layer.
Isolated deployments
Each client build runs with its own login pool and its own database. There is no shared multi-tenant blob to leak across.
Backups we actually restore
Managed backups with point-in-time recovery on AWS us-east-1. We test restores, not just snapshots.
Least-privilege networking
Service-to-service auth with short-lived credentials. No standing admin access.
04. Audit & monitoring
Every action. Logged.
Full attribution on every view, click, export. SSO with the providers your team already uses. Automated monitoring with a documented response process.
Need a deeper review?
Built on trust.
Send the questions your security team needs answered. We'll reply with the documents we can share today and a schedule for what's in flight.