Passwords hashed with bcrypt; JWT and httpOnly session cookies; forced password change for invited users.

Role-based access control with tenant-scoped authorisation on every API route and WebSocket.

Secrets live only in environment variables — never in the browser or repository.

Signed webhooks (Slack HMAC v0, cron bearer secrets, idempotency keys) and rate-limited public forms.

Immutable audit trail for every response action, policy change and administrative operation.