Security

Tenant isolation is mandatory. Your organisation id in the URL is a convenience, not authority.

Row-level security on tenant tables. Service-role keys never ship to the browser.
Financial changes, credentials, and signing run on the server with explicit authorisation.
Evidence used in a sent claim is not overwritten when the source system later changes.
Platform operators require MFA. Emergency tenant access is time-limited, logged, and visible to the merchant.