Docs / Security & compliance

Access control & audit logs

Access control

• Organization isolation — every record is scoped to your organization; users authenticate into exactly one org and cannot query across that boundary (it’s structural, enforced by how data is keyed, not just a filter)
• Roles — admin vs member gates billing, settings, locations, and team management; case work is open to both
• Sessions — sign-in via secure, HTTP-only session cookies; password reset and email verification flows are handled by our identity provider (WorkOS)

The audit trail

Every case carries an Activity tab: creation, uploads, extraction runs, checklist changes, outreach sent, e-signature events, submissions, decisions, ADR actions — each attributed to the user (or “System”) and timestamped. Org-level events (billing changes, member changes) are logged the same way.

This is your HIPAA-friendly answer to “who did what, when” — and why shared logins are a bad idea: attribution is only as good as account hygiene.