Security designed around tenant boundaries.

Clerk manages sign-in, sessions, invitations, and organization membership. Every protected tenant API validates the signed-in user’s active organization and membership before returning or changing organization data.

Viewer, administrator, and owner capabilities follow least-privilege boundaries. Sensitive owner actions—including organization data-key rotation and ownership transfer—are separately restricted and audited.

Watchlists, client dependencies, exposure results, notification routes, and audit records are scoped by organization. Membership in one organization does not grant access to another.

Global administrators operate platform-level health and notification controls. That role does not bypass the active-organization membership checks protecting tenant inventory.

Client identity, geography, service selection, provider, region, and dependency notes are encrypted with AES-GCM before database storage. Each organization has its own data-encryption key, wrapped by a separately hosted master key.

Notification destination credentials are also encrypted. Cloudflare provides encryption at rest for D1 storage and TLS for data in transit; application-layer encryption keeps protected tenant fields unreadable in ordinary database exports and direct SQL inspection.

Cloudflare protects and operates the edge runtime, while collector telemetry, application alerts, Slack escalation, and independent Better Stack monitoring expose source or scheduler degradation.

Versioned deployments, separated staging and production environments, database migrations, secret rotation, Worker rollback, and D1 recovery rehearsals support controlled incident response.

Beta participants should report suspected unauthorized access, exposed credentials, or unexpected data visibility immediately through their onboarding contact or the authenticated Support control. Reports are triaged without including sensitive tenant contents in shared notifications.