You are asking us to hold the contracts, delivery records and dispute correspondence that decide whether a balance is recoverable. Here is exactly how that is handled.
Every business record carries the workspace it belongs to, and every read is filtered by it inside the data-access layer rather than at the route. A record id guessed or copied from another workspace resolves to a 404, not to data. Mutating handlers re-assert ownership before they write.
Authentication, record changes, evidence decisions, exports, settings changes and every automated action are written to an audit trail that is never updated or deleted. Reversing an automated action writes a new event; it does not erase the original.
Your customers act without an account. That convenience is bounded: links are signed, purpose-scoped, time-limited and revocable, and only a keyed hash of the token is ever stored — a database read cannot reconstruct a working URL.
Every document is screened before it is accepted, stored in private object storage encrypted at rest, checksummed and versioned. Nothing is served from a public URL: every download passes back through an authenticated, tenant-checked route. Superseding a document keeps the prior version — an evidence pack has to be reconstructable exactly as it stood on the day it was sent.
Nothing here is designed to trap you. Any case exports as a self-contained evidence pack that opens in any browser a decade from now. The whole account exports as readable files whenever you ask, at no charge.
Four roles, mapped to how finance teams actually divide the work: account owner, supervisor, operator and auditor. Auditors read everything and change nothing, so you can give an external reviewer access without giving them the ability to alter a record.
Data is encrypted in transit and at rest. Backups are taken on a documented schedule and restoration is tested rather than assumed. Retention periods and the deletion workflow are written down and configurable per workspace, on a privacy-by-design basis: we hold the minimum needed to make a balance defensible, and no more.