Built to be scoped, logged and pinned
The platform treats access, isolation and audit as the product, not the plumbing. Here is how it is put together.
Authentication
HS256-pinned JWT with HttpOnly cookie sessions, 2FA, and Google or GitHub OAuth.
Authorization
Seven roles from Super Admin to a read-only seat, plus a scoped Client Portal.
Tenant isolation
Every query is scoped to the organization, so records never cross tenants.
Audit trails
Changes are written to an audit trail you can review, scoped per org.
Input safety
Inputs are sanitized against injection before they reach a query.
Data residency
Region is configurable and pinned per org. New orgs default to Mumbai, ap-south-1.
Honest posture
- SOC 2 readiness in progress — we state readiness, not a certification we do not hold.
- Sessions are HttpOnly and tokens are kept out of client storage where possible.
- Role checks run on every request, not only in the interface.
Security questions before a pilot?
Tell us your requirements on residency, access and audit, and we will walk through how Assemble meets them.