Security by enforced boundaries

Identity and sessions

• Native Supabase phone OTP with short-lived sessions and server-side claim verification.
• No service-role or database administrator credential is exposed to browser code.
• Role routing for partner, employee and administrator workspaces.

Data isolation

• PostgreSQL Row Level Security is enabled and forced on user-facing CRM tables.
• A partner can query only their own referrals, wallet, payouts and partner-visible updates.
• An employee can access only assigned cases; administrators operate under explicit policies.
• New customer phone entries use a server-side keyed fingerprint for duplicate checks and retain only the last four digits for display.

Documents

• Referral files live in a private storage bucket, not a public URL.
• Allowed uploads are limited to PDF and common image formats with a 10 MB maximum.
• Object paths are scoped by partner and referral; downloads use five-minute signed links.
• Document verification status and rejection reasons are separate from the file itself.

Financial integrity

• Commission quotes are locked from administrator-controlled rules rather than client-calculated values.
• Database triggers enforce valid commission and payout transitions.
• Wallet credits, holds, releases and debits are idempotent and recorded with unique references.
• Payout requests move balances atomically to prevent concurrent over-withdrawal.

Reporting a concern

Do not publicly disclose customer information or exploit a suspected weakness. Report it through the authenticated support channel with the affected URL, observed behaviour and safe reproduction steps. Never include live OTPs, passwords or unnecessary personal documents. The operations team will acknowledge and triage valid reports.