What protects your data, and what doesn't yet.

Every read and write is scoped to the caller's tenant before it reaches the database, and it is not a convention — dozens of end-to-end suites create two tenants and assert that neither can see the other's rows. Reverting a tenant filter makes those suites fail, which is how we know they are testing the thing they name.

PostgreSQL RLS policies ship with the product and are verified against the real database, so a query that forgot its filter would still return nothing. They are not enabled by default: RLS requires a non-superuser application role and a per-request session variable, and turning it on carelessly denies every query. It is a documented rollout, not a checkbox we have quietly ticked.

Mutations link into a SHA-256 hash chain — sequence, previous hash, hash — that any administrator can re-verify from inside the app. A row edited outside Opsylo breaks the chain at that point and the verification names it.

Platform AI keys and payment-integration secrets are held in AES-256-GCM envelopes. They are never returned to a browser and never written to a log; the console shows only whether a key is present.

RFC 6238 time-based codes with recovery keys, and refresh tokens that rotate on use — replaying a code or a spent refresh token is refused, and a reused token revokes the whole device family.

Per-identity and per-IP sliding windows on login, two-factor verification, API keys and public endpoints. It is real enough that it throttles our own test runs, which is a nicer way to find out than the alternative.

Deletes are soft across every entity — flagged, timestamped and attributed — so a mistake is recoverable and a deletion is itself a fact in the record rather than the absence of one.

Export and erasure are self-service. Erasure redacts personal data in place so the accounting ledger stays balanced — a financial record cannot simply vanish because a contact exercised a right, and it does not have to.