Multi-tenant isolation
Every record is organization-scoped. Workspaces do not share data planes.
Trust
Controls that match how money moves.
Services software touches time, invoices, and client data. Kestrio treats access, audit, and isolation as product — not a footer claim.
RBAC & permissions
Granular permission engine on routes. Custom roles, member assignment, global vs owned access.
Audit logging
Mutating operations write audit logs with computed diffs. Exportable history for compliance review.
Authentication
Sessions via Better Auth, TOTP two-factor, WebAuthn passkeys, and SSO/SAML on eligible plans.
Feature gates & quotas
Plan entitlements enforced at the API — not just hidden UI.
Client portal sessions
Separate portal auth surface with invites, verification, and scoped project visibility.
Security questionnaire?
Send your vendor packet — we'll respond with architecture and control details appropriate to your stage.
[email protected]