Platform
Security and data governance
Who can read what, decided by the record's owner, enforced by the server, and visible afterwards.
01
The three rules
- Consent is the model
- Cross-party reads happen because they were granted, can be paused, and can be revoked — by the party whose data it is, not the party reading it.
- The server decides
- Access is enforced where the data lives. A client that forgets to hide something must not be able to read it either.
- Reads are visible
- A grant leaves a trail, and so does a refusal, so the owner can see who looked and when — not merely who currently holds access.
02
Where data lives
Each product runs its own deployment and its own database, under a role that cannot reach the other's. Nothing is shared between them at rest.