Trust architecture
Security follows the company, record, and action.
Rivetra combines company-scoped authorization, MFA-sensitive administration, protected provider tokens, financial integrity checks, immutable document evidence, and accountable AI approvals.
Defense in depth
No single client screen is trusted to protect a record.
Authenticated API requests derive company and user context from verified identity. Route dependencies and Firestore rules enforce company scope so a resource identifier alone is not enough to cross a tenant boundary. Administrative and owner operations add role and MFA checks.
Financial calculations use fixed-point money handling and server validation. Payment and bank event IDs are recorded for idempotency. Finalized invoice and ledger history uses controlled corrections and soft deletion rather than silent destructive removal.
Electronic signature envelopes freeze the presented document, store a canonical hash and audit events, capture electronic-record consent, and require applicable notices before acceptance. AI-generated documents and public content record human approval rather than presenting model output as independently authoritative.
Company identity is checked at API and data-rule boundaries.
Provider credentials remain outside the mobile bundle and repository.
Consequential changes retain actor, time, state, and relevant version.
Access, correction, export, deletion, and retention pathways are documented.
Security questions
Plain answers about protection.
Can one Rivetra company see another company's records?
The architecture is designed to reject cross-company reads and writes using authenticated company scope at API and Firestore boundaries.
Are provider secrets stored in the app?
No. Production secrets are stored server-side, including Google Secret Manager where configured, and are not committed to source control or embedded in the public client.
How do I report a vulnerability?
Email security@rivetra.app with reproducible details. Do not access, retain, or disclose data that does not belong to you.