Tenant isolation enforced by the database

Every customer-owned table carries an organization id with PostgreSQL row-level security. The application runs tenant work as a role that cannot bypass it, and each request is pinned to one organization. A query that forgets its tenant filter returns nothing rather than someone else’s data. Isolation is tested by having one tenant attack another.

Separate demo and production

The free demo and the production application are different deployments with different databases, storage, session cookies and keys. A demo account cannot sign in to production, and the demo can never reach a real SAP tenant.

Passwords and sessions

Passwords are hashed with scrypt. Session cookies are random, HttpOnly, SameSite and Secure; only their digest is stored. Sign-in is rate limited. Verification, reset and invitation links are single-use and stored only as digests.

Approvals and separation of duties

Mappings, plans and exceptions need an authorised approver. In production the person who wrote a mapping cannot approve it, and the people who approved a mapping or plan cannot execute against SAP. Execution needs a second person to confirm.

An audit trail the application cannot rewrite

Audit events are append-only: the application role can insert and read them and nothing else. They record identifiers, counts and decisions, never HR record values or credentials.

Sensitive data is kept out of the wrong places

National identifiers, pay, bank and termination data are never placed in logs, finding samples, rejected-record files or audit detail, and are never sent to a language model. Columns that look sensitive are masked in the interface.

Credentials are encrypted and write-only

Stored SAP credentials are encrypted with a key derived per organization from a master key held outside the database. They can be written but never read back through the application, and never reach the browser, logs or an AI prompt.

Untrusted files are treated as untrusted

XML with DOCTYPE or entity declarations is refused, uploads are type- and size-checked, archives are not accepted, and spreadsheet-formula values are flagged. Transformation rules are a closed vocabulary with no code evaluation.

Production writes to SAP are off by default

Direct API loading needs a deployment switch, a plan entitlement, a validated connection, a per-entity allow-list, approved mapping and plan, a passing preflight and a typed confirmation by a second approver. A failed write is never retried automatically.

Send them to writetomadhusudan@gmail.com. Specific questions get specific answers, including where the answer is “not yet”.