Security by design
Security
CALAPPA does not bolt security on later: isolation, authorization and audit are part of the product.
Tenant isolation
Each organization is separated by RLS policies and current authorization.
Least privilege
Roles and capabilities limit every operation to the access required.
Protected credentials
Secrets, PINs and kiosk credentials are not exposed to the browser or logs.
Audit and idempotency
Critical operations retain traceability and replay protection.
Private data
Documents and evidence stay private and are authorized before every access.
Verified payments
Stripe integrates through signed events and idempotent processing.