Workspace isolation
Workspace-owned tables use Row Level Security, explicit grants and negative cross-workspace tests.
SECURITY
Clear boundaries for operational data.
isa uses Postgres-enforced workspace isolation and typed Hotel records. This page describes current controls without making certification claims.
IMPLEMENTED CONTROLS
What the current product enforces.
Transactional booking rules
Physical-room overlap is enforced by a PostgreSQL exclusion constraint under a workspace lock.
Immutable collections
Recorded payments are append-only rows and cannot exceed the reservation total.
Reduced payment scope
isa does not store card numbers or security codes. Current payments are manual collections; hosted checkout is still in development.
SCOPE AND STATUS
Security work continues with the product.
There is no SOC 2, ISO 27001 or PCI DSS certification claim. Production hosting, MFA, monitoring, incident response and independent security testing remain separate readiness work.