Defense in depth
Multiple layers of protection work together so a failure at one layer doesn't expose your data.
Row-level security
Database-level policies scope every query to the caller's organization and ownership.
Server-side authorization
Every privileged action is authorized on the server — never trusted to the client.
Secure authentication
Email verification, password reset, session management, and no plain-text password storage.
Audit logging
Tamper-evident audit events for privileged changes, document access, and security operations.
Least-privilege roles
Distinct admin, owner, manager, and viewer roles — each with only the permissions it needs.
Private document storage
Short-lived signed download URLs issued only after server-side ownership verification.
What we don't do
Security is also about restraint. AbateInvestments is designed to avoid common vulnerabilities and to never expose what shouldn't be exposed.
- No passwords stored in application tables or browser storage
- No service-role keys or secrets in client-side code
- No private documents exposed through public URLs
- No client-controlled authorization for sensitive resources
- No self-promotion to administrator roles
- No error messages that leak secrets or private records
Compliance posture
AbateInvestments operates as a tracking, portfolio management, and information platform. It does not function as a broker-dealer, investment adviser, custodian, or issuer. Real investment offerings require a separately reviewed compliance configuration. We do not claim regulatory compliance, certification, or security accreditation unless independently established.