Server-side authorization
Every privileged read and write goes through a server function that re-validates the caller's bearer token and role. Route guards control what the interface shows; they are never the security boundary.
Security
Isolation, determinism and least privilege
ObligePay handles contracts, invoices and operational evidence. The controls below describe what is implemented in the product today — not certifications, which we do not claim.
Controls
What is implemented
Row-level security and tenant isolation
Every tenant table carries an organization reference and is protected by row-level security policies that resolve membership through a security-definer check. One customer's queries cannot return another customer's rows, regardless of what the client sends.
Role separation
Roles live in a dedicated table, never on a user profile, and are read through a database function. Customer, support, admin and super admin are distinct. Customers cannot reach the admin command center.
Password handling
Passwords are handled entirely by the managed authentication service. The application never stores, logs, transmits or displays a plaintext password, and administrators cannot view an existing password — only trigger a reset.
Secret handling
AI and service credentials are read inside server-only handlers. Nothing sensitive is prefixed for client exposure, so no key is present in the browser bundle. The service role key is never referenced from client-reachable code.
Upload validation
Uploads accept PDF, PNG, JPG and JPEG only. Type and size are validated server-side, not just in the file picker, and objects are stored under a per-organization prefix with access-controlled reads.
Input validation
Server function inputs are schema-validated before use. AI output is validated against the same kind of schema before it is stored, so a malformed model response cannot corrupt a record.
Rate limiting architecture
Expensive operations — document extraction, evidence fetches, authentication attempts — pass through a shared per-identity throttle checkpoint so limits can be enforced consistently as volume grows.
Security headers
Responses set a strict referrer policy, frame and content-type protections, and a restrictive permissions policy.
Administrative audit logging
Sign-ins, user and role changes, password reset requests, forced resets, session revocation, suspensions, certificate changes, settings changes and data exports are written to an append-only activity log readable only by staff roles.
Verification
Tests we hold ourselves to
- A member of customer A cannot read or write any record belonging to customer B.
- A customer-role account cannot load the admin command center or invoke a privileged action.
- An authenticated but unauthorized role cannot perform staff-only operations even by calling the endpoint directly.
- The AI provider key is absent from every browser bundle and network response.
- Financial calculations are deterministic: the same inputs always yield the same cents.
Honest limits
What we do not claim
ObligePay holds no security certifications or audit attestations, and this page should not be read as a compliance statement. We do not claim legal or regulatory compliance on your behalf, we do not guarantee savings or recovery outcomes, and we make no patent claims. Live evidence integrations are not yet connected; the mock providers in the product are labelled as simulated wherever they appear.