Security is an architecture decision, not a feature

Here is what AnswerBnB actually does today — described plainly, without inflating it into claims we can't back.

Authentication

AnswerBnB uses real Supabase Auth sessions — no custom password storage, no session tokens handled outside a maintained auth provider. Passwords are never visible to or stored by the application itself.

Role-based access control

Every user belongs to an organization through an explicit membership record with a role (such as owner or manager). Access decisions are made from that membership, not inferred from what a page happens to display.

Tenant isolation, enforced server-side

Every authenticated API route checks organization access before touching any data. An organization ID supplied by a client is never trusted on its own — it is checked against the caller's real memberships on every request. This is not just hidden in the interface; a request for another organization's data is rejected at the API layer regardless of what the UI shows.

Database-level scoping

Tenant-scoped queries require an explicit organization filter as a matter of code convention, checked in code review and in a shared query helper — a defense-in-depth layer underneath the API-level check, not a replacement for it.

Secure credential handling

AI provider keys, database credentials, and service-role keys live only in server-side environment configuration. They are never sent to the browser, embedded in client-side JavaScript, logged, or written into this repository's documentation.

Auditability

Conversations, AI decisions, and escalations are recorded as real records tied to the organization and user that produced them — not only visible in a transient chat window.

AI guardrails

The AI is built to escalate rather than guess when its available knowledge doesn't support a confident answer, and to stay within the property (or, more generally, the organizational scope) it has been given context for.

Controlled integrations

Every external integration is designed to pass through a normalized adapter layer rather than talking to vendor APIs directly from application code — see Integrations for what exists today.

What we don't claim

AnswerBnB does not currently hold SOC 2, ISO 27001, HIPAA, or PCI certification. If and when any of those are pursued and achieved, this page will say so — and not before.