Organization isolation
Every core record is scoped to an organization. App routes and API handlers use organization membership checks before serving data.
Loading Credvara…
Loading Credvara…
Security
Credvara handles business-critical receivables data. The product architecture is built around tenant isolation, secure server access, auditability, role controls, and safe AI usage.
Organization-scoped authorization for app and API access.
InstantDB permission rules for membership-scoped tenant isolation.
Server-only admin-token usage and no admin-token exposure in client code.
Audit logs for sensitive workspace, import, billing, notification, and evidence-pack actions.
CSV upload validation and import row rejection for malformed customer, invoice, and payment data.
Deterministic AI fallbacks and prompt guards for production reliability.
Security headers and production middleware protections.
Role-aware access for owner, admin, accounts, and viewer users.
If you believe you have found a vulnerability, contact the team with clear reproduction steps and avoid accessing or modifying data that does not belong to you.
Security model
Credvara handles invoice, customer, payment, and follow-up data. The production architecture is designed around tenant isolation, server-side authorization, auditability, and controlled AI usage.
Every core record is scoped to an organization. App routes and API handlers use organization membership checks before serving data.
Permission rules scope reads to active workspace membership while sensitive mutations run through server routes with role-aware checks.
Sensitive operations run through server routes. Admin-token access is isolated to server-only files and never exposed to browser code.
AI generation uses prompt guards, deterministic fallbacks, and sensitive-data minimization for follow-up and evidence-summary flows.