Organization boundaries are part of the product foundation.

Current controls

Verified identity

Authentication is handled through Supabase Auth. Protected operations validate the signed-in identity before access is evaluated.

Tenant isolation

Postgres Row Level Security and active organization membership define the data boundary. Application roles do not replace database enforcement.

Authorization

Role checks are enforced in the database and server paths for supported organization actions.

Invitation safety

Invitation tokens are stored as SHA-256 hashes, expire after seven days and are bound to the invited verified email.

Audit evidence

Critical organization actions are recorded as traceable events. Security documentation will be expanded as additional production controls are certified.

Security contact

Report a concern privately to admin@ideasforgeai.com. Do not include passwords, private keys or sensitive employee records.