Security & data
Boards and owners ask this before anything else, so here is the actual answer rather than a badge.
Isolation is enforced by the database, not by careful code
Every table carries the organization a row belongs to, every row-level security policy is scoped to the current organization, and every foreign key between two of those tables is composite. Postgres itself rejects a cross-organization read or reference, including from a connection holding the service role. An application bug cannot leak another organization's data, because the query never returns it.
There is no super-admin account
No platform-wide role can see across organizations. When support needs access, your organization issues a time-boxed support membership and revokes it afterwards. Nobody holds standing access to your data.
Permissions are yours to set
Roles, and what each role can do, are per-organization settings rather than fixed tiers. A treasurer sees the ledger, a shift lead sees the schedule, a board member sees the minutes — you decide, and you change it without filing a ticket.
An audit trail on the records that matter
Who changed a financial record, a membership, a role or a resolution, and when. The questions that actually come up are about money and access, so those are what is logged.
Export and deletion on request
A full export of your organization's data is a feature, not a support request — it was built before the second organization was onboarded. Deletion on request is honored, and data-retention rules you set decide how long anything else is kept.
Your public site is the only public part
Everything in the portal sits behind authentication and is scoped to your organization. What the world sees is the site and the calendar you chose to publish.
Where it runs
The application runs on Vercel, the database is managed Postgres on Supabase, DNS and CDN go through Cloudflare, and transactional email is sent through Resend. Primary infrastructure is in United States regions, and backups run nightly.
Questions your board needs in writing
Ask, and you will get a written answer rather than a sales call. Security questionnaires are fine too.