Security

Parcels, people, contracts and photos belong to an organisation. Every database query binds the request to your own account; if nothing matches, the system answers “not found” rather than “not allowed” — otherwise the answer would reveal that someone else's record exists. Automated checks over the source code enforce this.

IDs appear in every response of your own interface and are no secret — but nobody may enumerate them. Every route that accepts an ID checks account membership before releasing anything.

A public map link expires and carries only harmless colourings. Owners, lease end dates, soil indices, contracts and management notes are never included in a shared link.

Requests to the language model run exclusively through the application itself. No API key sits in the browser, and without a session none of these routes accepts a request.

When an account is locked or terminated, open sessions are ended. Otherwise anyone signed in would keep working until their cookie expired, and the lock would be nothing but a label.

Every state-changing administrative action is recorded in a log. That is not protection against the operator but the answer to “since when has this been the case, and who did it”.

A complete project state can be captured and restored at any time — before a big change, the simplest insurance there is.

Parcels as shapefile, evaluations as CSV, schedules and contracts as PDF. Whoever leaves takes everything with them.