Commission data is payroll data. Here is how we treat it.
Every workspace table is protected by PostgreSQL row-level security. Each request runs with its workspace — and, for reps, its rep — set inside the transaction, so a query cannot read another workspace’s rows even if application code forgets a filter. Reps can only ever read their own lines and statements.
Passwords are hashed with Argon2id. Sign-in by magic link, optional TOTP two-factor authentication with one-time recovery codes, sessions in HttpOnly cookies that expire when idle, rate limits on sign-in and e-mail.
Integration tokens, webhook secrets and two-factor seeds are encrypted with ChaCha20-Poly1305. Only hashes of session and one-time tokens are stored.
Plan changes, deal edits, imports, period closes, role changes and billing events are written to an append-only audit log with the actor and IP. Closed periods are never rewritten: late changes become explained adjustments in the next period.
Strict Content-Security-Policy with no inline script, CSRF protection on every form, HSTS, and signed webhooks.