Security & data handling

Every municipal record belongs to exactly one organization, and isolation is enforced with row-level security in Postgres — not in application code that could be bypassed. Public/anonymous access to the database is zero. Cross-organization references are additionally blocked by composite database constraints, and the write path for every table is proven by an automated authorization test suite that runs against the real schema (115 assertions at this writing).

Contractors submit updates through single-purpose secure links — no contractor accounts, no shared passwords. Tokens are random, transmitted once, and stored only as keyed cryptographic hashes; the raw token is never written to the database or to logs. Links expire on a deadline, are revocable immediately and irreversibly (revocation is enforced by the database, not just hidden in the interface), and spent link hashes are purged on a documented retention schedule. Public endpoints are rate-limited.

Meaningful actions — sending and revoking links, review decisions, report transitions, edits to report statements, evidence access — append audit events written inside the same database operations they record. There is no code path that performs the action but skips the trail, and no API role that can write a false trail entry attributed to someone else.

Nothing is ever auto-published. A report reaches its final state only through an approval that records the approving staff member and timestamp — a database-enforced gate, so an approval cannot be forged and an approved record cannot be silently destroyed or altered. Original contractor submissions and their evidence are preserved verbatim; review happens alongside the record, never by editing it.

Report drafting is machine-assisted and human-released: every material statement in a draft carries references to the submission, evidence, or record it came from, and statements are labeled by kind — restated fact, computed figure, or inference. The drafting layer is contractually barred from engineering, legal, financial, procurement, or public-safety determinations and from rating contractor performance; drafts that violate those bounds are rejected automatically before anyone sees them. Live model-generated drafting is currently disabled by default and gated behind additional verification controls that check the model's quoted evidence against the stored records.

Evidence uploads are restricted by type and size, stored in private storage, and served only through short-lived signed URLs. The public site ships a production content-security policy, serves no third-party scripts, and sets no cookies on public pages. The current public deployment runs entirely on fictional demonstration data with no production database and no stored secrets beyond a single transactional-email key.

The five core surfaces — landing, login, dashboard, the contractor submission form, and the report review view — are scanned against WCAG 2.1 A/AA criteria in the automated test suite and currently pass with zero violations. Accessibility gaps we know about are tracked openly and closed deliberately.

Every schema or authorization change ships with automated database-level tests, and each development milestone undergoes an independent security review whose findings are recorded — and resolved or explicitly accepted — in a risk register kept in the project repository. Full technical documentation (data model, authorization model, retention policy, AI-provenance rules) is available to reviewing municipalities on request.

No SOC 2 or ISO certification. No third-party penetration test yet. No uptime SLA, because no production municipal deployment exists yet — pilot agreements will state real commitments for a real deployment, including backups and recovery. We would rather list these plainly than imply them; when one changes, this page changes.