Here is what AnswerBnB actually does today — described plainly, without inflating it into claims we can't back.
AnswerBnB uses real Supabase Auth sessions — no custom password storage, no session tokens handled outside a maintained auth provider. Passwords are never visible to or stored by the application itself.
Every user belongs to an organization through an explicit membership record with a role (such as owner or manager). Access decisions are made from that membership, not inferred from what a page happens to display.
Every authenticated API route checks organization access before touching any data. An organization ID supplied by a client is never trusted on its own — it is checked against the caller's real memberships on every request. This is not just hidden in the interface; a request for another organization's data is rejected at the API layer regardless of what the UI shows.
Tenant-scoped queries require an explicit organization filter as a matter of code convention, checked in code review and in a shared query helper — a defense-in-depth layer underneath the API-level check, not a replacement for it.
AI provider keys, database credentials, and service-role keys live only in server-side environment configuration. They are never sent to the browser, embedded in client-side JavaScript, logged, or written into this repository's documentation.
Conversations, AI decisions, and escalations are recorded as real records tied to the organization and user that produced them — not only visible in a transient chat window.
The AI is built to escalate rather than guess when its available knowledge doesn't support a confident answer, and to stay within the property (or, more generally, the organizational scope) it has been given context for.
Every external integration is designed to pass through a normalized adapter layer rather than talking to vendor APIs directly from application code — see Integrations for what exists today.
AnswerBnB does not currently hold SOC 2, ISO 27001, HIPAA, or PCI certification. If and when any of those are pursued and achieved, this page will say so — and not before.