Tenant isolation is the product, not a footnote.

How workspaces stay separate

Each business is a tenant. Staff JWTs carry that tenant. Requests that do not match are rejected. Customer storefront sessions are scoped to the shop they signed into — not the whole platform.

Access control

• Role-based permissions inside the ERP workspace.
• Audit trails for sensitive staff actions.
• Rate limits on public auth and OTP routes.
• Google sign-in for customers uses a server-side OAuth exchange.

Files and logos

Public shop logos and catalog images are stored on Cloudinary when those keys are configured. Sensitive documents use authenticated storage, not the public CDN.