Team & Security

Security & tenant isolation

How Billing keeps businesses separate, protects shares, and retries safely.

Tenant isolation

Every request is scoped to the active business and your resolved permissions. Staff never cross businesses unless they are an accepted member of each. Switching businesses switches the entire dataset.

Accept-before-access

Invited users cannot set a business active or call ERP until their membership is active (accepted). Revoking a member returns 403 for that business immediately.

Document links and customer-portal links are capability URLs — anyone with the link can view that specific content. They are not a substitute for staff login. Treat them like a password: share deliberately, and use expiry. Portal links reuse an existing active share rather than minting duplicates.

Owner-only settings

Sensitive settings — document numbering and compliance policies — are owner-controlled, so staff cannot change statutory numbering or compliance switches.

Safe retries (idempotency)

Billing mutations are designed to be retried safely after a network error, so a repeated issue, payment, or share does not create duplicates.

Public UPI page

The public invoice page shows only an invoice summary and a UPI option for unpaid invoices; it carries no login and no PII beyond the invoice summary.