Security & Access
Authentication, RBAC, record scopes, audit logging, and secure document handling for staff and Customer Portal users.
Last updated: August 2026
Security combines authentication, RBAC, record scopes, and audit logging. Every state change on Leads, Customers, Opportunities, payments, and Onboarding cases is traceable to an authenticated user.
Access controls
- Staff authentication: session-based login with optional two-factor enforcement
- RBAC: permissions checked on every controller action
- Record scopes: OWN, TEAM, DEPARTMENT, and ALL limit query results
- Customer Portal: strict customer self-scope; portal users see only their own records
Data handling
Private documents never live in public web directories. Integration credentials are encrypted at rest. Audit logs capture who changed what and when for compliance and operational review.
Never rely on frontend UI to hide records. All authorization is enforced server-side through policies that combine permissions with record scopes.