Security

1. Security principles

• Multi-tenant authorisation is enforced at the database boundary, not only by hiding interface controls.
• Operational records are scoped to an organisation and access is derived from explicit organisation membership.
• Client Portal access is separately scoped to the authorised customer/counterparty.
• Privileged platform support must select a tenant explicitly and does not rely on impersonating a customer identity.

2. Authentication and access

• Email/password authentication is provided through Supabase Auth.
• Role and membership checks are enforced for administrative and operational mutations.
• Pending invitations consume plan/access slots where applicable to prevent limit bypass.
• Service-role credentials are not exposed to browser code.

3. Data and infrastructure

The production Supabase project is configured in eu-west-3 (Paris, France). The Vercel application project is configured for cdg1 (Paris, France).

Application traffic uses HTTPS/TLS. Hosted infrastructure relies on provider-managed storage, network and platform security controls.

4. Tenant and portal isolation

• Database policies and reviewed SECURITY DEFINER functions enforce tenant and role boundaries.
• Client Portal users derive organisation and counterparty context from their active portal membership rather than trusting caller-supplied tenant identifiers.
• Customer-facing documents and storage paths are restricted to records authorised for that portal context.

5. Audit and change control

• Sensitive organisation and Client Portal membership/invitation changes are recorded in access audit events.
• Database authorisation changes are reviewed with adversarial tests and Supabase security/performance advisors.
• Production releases require typecheck, lint, unit tests, production build and smoke test before merge.

6. Vulnerability and incident reporting

Security concerns should be reported privately to legal@lytheron.com. Please include the affected URL, a clear description, reproduction steps and impact where possible.

Do not access data that does not belong to you, disrupt production, use social engineering, or publish a vulnerability before Lytheron has had a reasonable opportunity to investigate.

7. Certifications

This page describes implemented controls and architecture; it does not claim ISO 27001, SOC 2 or another certification unless Lytheron explicitly publishes such certification.