Each town's data stays separate. Here is exactly what is built and what is not.

In the current build

• Tenant isolation in two layers. Every request checks the user's membership on the server, and PostgreSQL row-level security hides other towns' rows even if the app made a mistake.
• Isolation tests. Automated tests try to read, change, list and download another town's data and expect a not found answer.
• Five roles. Organization Owner, Administrator, Department Manager, Reviewer and Read-only Viewer. Each page and action checks a named permission.
• Audit log. Sign-ins, role changes, uploads, downloads, deletions and commitment status changes are written to an append-only log.
• Careful file intake. Uploads are limited to PDF, DOCX, TXT, XLSX and CSV up to 25 MB. The type is checked from the file contents, and each file gets a SHA-256 checksum.
• AI with a person in charge. AI suggestions wait in a review queue. Each quote is checked word for word against the document, and only a reviewer can turn a suggestion into a record.
• One-time links. Invitations and administrator reset links work once and expire. Only a hash of each link is stored.
• Sign-in protection. Passwords are hashed with scrypt, sessions live on the server, and accounts lock after repeated failed sign-ins.

Planned before a production pilot

• Single sign-on and MFA. Sign-in through the town's own identity provider, with multi-factor authentication.
• Real malware scanning. Today uploads pass a placeholder check. A real scanning service will be connected before any town uploads real files.
• Private object storage and key management. Files move to private object storage with encryption at rest, managed keys and a rotation process.
• Retention and export. Retention periods, legal hold and full data export set by each town.
• Documentation for reviewers. A data-flow diagram, subprocessor list, incident-response plan and accessibility statement.
• AI provider terms. A written choice of AI provider, region and data retention terms before real town documents are processed. Town documents are not to be used for training shared models.