Every byte, walled off.
Firm data lives behind two enforcement layers. Identity is offloaded to providers built for it. Object storage is segmented at the source. Privilege, work product, HIPAA, and ABA Model Rules sit as the baseline, not a checkbox.
Two walls. Every byte protected.
Tenant boundaries are enforced twice. Once at the application layer, where every query carries the active org and company. Again at the database layer, where Postgres row-level security rejects anything without a matching tenant. Bypassing one wall doesn't bypass the other.
App-layer scoping
Every API call carries the active org and company. Services build queries from that context, not from raw user input. A request without scope returns nothing.
Row-level security
Postgres RLS enforces tenant boundaries at the row, not the application. Even a misfiring query, a missed scope, or a direct SQL connection cannot return another tenant's data.
Defense in depth
Together, the two walls protect every byte of tenant data from leaking to another company or another vertical. A single failure cannot expose anything; it would take simultaneous failures of both walls.
Login credentials we never see.
Adaptive doesn't house your passwords. Staff sign in through Auth0, the identity provider used by Fortune 500s and security-first startups. External users authenticate with magic links: short-lived, single-use, and revocable from the admin console.
Auth0 for staff
All staff authentication runs through Auth0. Passwords, MFA, recovery, SSO. We never store, hash, or reset a credential. If a credential is exposed elsewhere, your Auth0 admin closes it.
Magic links for external users
Public users never make accounts. They get a one-tap link in SMS, valid for a limited window, single-use, and revocable. No passwords to forget, no passwords to leak.
Attachments, segmented at the source.
Every uploaded artifact lives at a tenant-prefixed key in R2 object storage. Reads are issued through signed URLs scoped to the requesting tenant. There is no URL pattern that lets one tenant guess at another tenant's files.
Tenant-prefixed keys
Every attachment lands at a path that includes the tenant ID. URLs never expose another tenant's prefix. Cross-tenant guessing is structurally impossible.
Signed, short-lived URLs
Reads are issued with signed URLs scoped to the requesting tenant and a limited time window. Even a leaked URL expires before it can be exploited.
Compliance, the baseline.
Beyond the isolation walls, the platform's defaults are tuned to keep tenants out of trouble.
Immutable audit log
Every action logged with actor, target, timestamp, and tenant scope. Six-year retention by default, aligned with state-bar record requirements. Compliance reads it; engineering treats it as a system of record.
Encryption everywhere
TLS in transit, AES-at-rest on Postgres and R2. Managed by the underlying providers, no DIY key handling.
Compliance, the baseline
HIPAA-class PHI handling and BAA support stay in the box because PI cases involve medical records. Attorney-client privilege, work product doctrine, and ABA Model Rules around confidentiality and retention sit alongside as defaults, not configuration.
Webhook signature verification
Inbound webhooks from Twilio, Auth0, and other providers are signed and verified before they reach business logic. A spoofed webhook never gets past the door.
Security that fades into the floor.
Walled off, signed, audited. Built so tenants don't have to think about it.