You're trusted with people's homes. We're trusted with the keys.

Every record in Dwellwatch belongs to exactly one company, and Postgres row-level security enforces that boundary on every query — in the database itself, not just in application code. One company can never read another's clients, properties, photos, or reports.

Five staff roles — owner, admin, ops manager, technician, and read-only — each see and do only what their job requires. Read-only users can look but never change; technicians work their visits without access to billing or company settings.

Homeowners sign in to a portal scoped to their own properties, enforced by the same row-level security. They see their reports, approvals, and history — never internal staff notes, never another client's homes.

Gate codes, alarm codes, and lockbox combinations are stored in a dedicated vault and never shown in lists. Revealing a secret is a deliberate action that requires a stated reason, and each reveal — who, which credential, when, and why — is written to the audit history.

Sensitive actions leave a permanent trail: credential reveals, record changes to protected data, and administrative actions are logged with actor, timestamp, and before/after values where relevant.

Authentication is handled by Supabase Auth with secure, httpOnly session cookies. Inspection photos and property documents live in private storage buckets and are served only through short-lived signed URLs that expire after one hour.