Security

Organization isolation

Every client, proposal, file, payment, and AI usage row carries an organizationId. Server actions load the caller’s membership first and refuse records from other workspaces.

Access control

Roles are Owner, Admin, Member, and Viewer. Billing changes require Owner.

Authentication

Passwords are hashed with bcrypt (bcryptjs, cost 12). Sessions are signed JWT cookies from Auth.js. Email verification and password reset tokens are stored as SHA-256 hashes.

Payments

Stripe webhook signatures are verified before any subscription or payment row is written. Unsigned events are rejected.

Report an issue

support@proposalfast.ai