Security and privacy

Permissions are enforced at the server

Every screen and API route is gated by permissions granted through roles. Holding a menu entry never guarantees the data behind it — the server checks the permission again on every request, and screens you cannot use show an honest "restricted" state instead of guessing.

Personal data is masked

Sensitive personal fields (personal email addresses, bank and tax identifiers, and similar) are masked by default and only visible to roles explicitly granted to see them. The masking happens at the server, so it applies to every consumer of the data, not just the main screens.

Everything important is audited

Significant actions — approvals, publications, configuration changes, template changes — are written to an append-only audit log with the actor, the action, and when it happened. The audit trail cannot be edited after the fact.

Password and session handling

Credentials are never stored in readable form. Sessions are revocable, and an administrator can force a sign-out for any account.