Trust at Warm Deals

AES-256 on all DB volumes via cloud provider keys.

TLS 1.2+ for all customer-facing endpoints.

TOTP-based MFA with backup codes, available for every account.

Per-organization OIDC SSO for enterprise tenants (Okta/Azure/Google/Auth0/generic).

Built-in roles (Owner/Admin/Manager/Member) plus per-org custom roles with permission matrix.

Append-only event log for security-relevant actions with filters and CSV export.

Email/phone/JWT/API-key/Bearer tokens are redacted from application logs.

Daily DB snapshots to MinIO with 30-day retention; restore tested.

Token-bucket limits on auth endpoints and webhook ingest.

Inbound provider webhooks verified by HMAC; outbound webhooks signed with HMAC-SHA256.