Security practices
Last updated June 9, 2026
Live posture
The claims below are backed by switches the software actually reads. Right now this deployment reports: organization isolation enforced at the database layer, authentication via Clerk, document encryption at rest when the operator configures the storage key, append-only audit on, and size-capped uploads. Signed-in users see the exact live values in Settings → Security.
Tenant isolation
Organization scoping is enforced in the repository layer — every deal-scoped query filters on the organization in SQL, and child records (documents, extractions, worksheets, add-back reviews) inherit the boundary by joining through their deal. Cross-tenant requests return 404. This is covered by automated isolation tests that run on every change, including cross-organization write attempts.
Encryption
In transit: production deployments enforce HTTPS, and HSTS is set on secure responses. At rest: uploaded documents are encrypted with an authenticated symmetric scheme (Fernet — AES-CBC with HMAC) when the operator configures the storage key; a wrong or missing key fails loudly rather than ever serving ciphertext as a document. Database-level encryption at rest is the hosting platform's responsibility (e.g. encrypted volumes) and is documented in the deployment guide.
Authentication & access
Application routes authenticate with Clerk session JWTs (RS256, verified against Clerk's published keys); destructive actions (deleting deals, documents, worksheets; changing firm-wide visibility) require the organization admin role. Service/CLI compute routes use API keys compared in constant time. A development mode without credentials exists for local work and announces itself loudly; the security panel reports which mode is live.
Integrity & audit
Financial records are append-only: corrections and recomputations create new revisions, never overwrite. Every rendered deliverable (memo, CIM, QoE document) embeds a provenance manifest naming the exact revisions behind its numbers. Numbers that fail validation are flagged, gated, or refused — never silently wrong.
Boundaries
Uploads are size-capped and validated; malformed documents and inputs are rejected with specific errors. Responses carry standard security headers (content-type sniffing disabled, framing denied, referrers suppressed). Branding images are restricted to inline data URLs and size-capped; user-supplied colors and logos are sanitized before they reach any rendered document.
Reporting
Suspected vulnerabilities: enterprise@narrowpathsystems.com. Please include reproduction steps; we ask for reasonable time to remediate before disclosure.
Questions: enterprise@narrowpathsystems.com · +1 (765) 697-8504 · Privacy · Security · Terms · Contact