Tenant isolation
Organization membership, role checks, tenant-coherent foreign keys, and database row-level security keep workspace data in scope.
Security architecture
Security controls built around tenant boundaries.
NamasteSuite combines database isolation, explicit role authorization, encrypted provider credentials, verified webhooks, and auditable background processing. We do not claim that any security control eliminates all risk.
Provider credentials
Reusable provider and conversion credentials are encrypted server-side. OAuth callbacks bind the user, workspace, provider, product, venue, expiry, and one-time state.
Verified events
Supported inbound webhooks verify provider signatures before processing and record delivery identifiers to make retries safe.
Bounded background work
Background jobs use bounded claims, leases, tenant isolation, retry limits, and safe diagnostics so one failing connection does not block another venue.
Report a security concern
Send a concise description and reproduction steps to security@namastesuite.com. Do not include provider tokens, passwords, private customer records, or destructive proof. We will acknowledge a credible report and coordinate safe validation.