Security
Your costs, your customers and your books are the most sensitive data you own. Here is exactly how Kerf protects them.
Kerf is multi-tenant: many companies share the same system. Most software keeps them apart with application code alone, so one missed filter can show one customer’s data to another.
Kerf adds a second wall underneath. The database itself enforces row-level security, and the application connects as a restricted user that cannot bypass it. Kerf refuses to start if that restriction is missing.
Your login proves who you are — nothing more. What you are allowed to do is worked out fresh from your roles on every request, so removing someone’s access takes effect within seconds, not when their session happens to expire.
Roles can be as broad as “admin” or as narrow as “only my own customers”. Nobody can grant a permission they don’t hold themselves.
Every change to your data is written to an audit trail automatically: who made it, when, and what the record looked like before and after. People with access to the audit log can review it from settings.
Attachments have no separate permissions to get wrong. If you can see a quote, you can see its files; if you can’t, you can’t. Downloads use short-lived signed links that expire on their own.
The Kerf assistant can read and prepare drafts, but anything beyond a draft needs a person to approve it, and anything sent to a customer always does. An approval covers exactly what you were shown — if the action changes after you approve it, Kerf refuses and asks again.
Every change the assistant makes is written to the audit trail, along with what was asked.
Passwords are stored as one-way hashes, sign-in attempts are rate-limited, and sessions use short-lived access tokens.