Tenant-scoped authority
Hosted data access is bound to validated organization membership and database role boundaries rather than request-controlled tenant headers.
Security boundaries
Security claims stay tied to implemented controls.
InvoiceRig uses tenant-scoped authorization, least-privilege runtime roles, bounded error surfaces, and explicit credential and evidence boundaries. Public pages never expose protected run content.
Credential separation
Provider credentials are handled through dedicated encrypted custody boundaries and are not placed in public metadata, evidence JSON, logs, or browser storage.
Evidence hygiene
Technical evidence favors hashes, typed outcomes, and bounded identifiers. Raw invoice and provider bodies are excluded from public SEO content and share-safe summaries.