A normal tenant user cannot reach another tenant's debtors, cases, payments, documents or audit records — the active-tenant context is checked on every request, and an invalid or unassigned tenant returns 403.
Role-based access control and tenant authorization are enforced at the platform layer, not left to individual endpoints to implement correctly one by one.
Tenant lifecycle changes, access events and data-subject actions are all recorded for review, alongside request IDs, tenant ID, user ID, action, latency and error on every call.
Tenant-level data isolation, retention rules, access logging and data-subject workflows are built into the model, not added as an afterthought on top of it.
The architecture supports deployment in South Africa and avoids unnecessary cross-border movement of debtor data by default.
No credentials in source control, no credentials in model defaults, and least-privilege access enforced throughout the platform.
Every schema change ships with an Alembic migration, an upgrade path, a downgrade path where practical, a data backfill, validation, and a regression suite before it reaches a tenant.
Debt review status, prescription, and Section 129/130 notice procedures are checked on the account before a collector can act — alignment with the National Credit Act and National Credit Regulator, not a separate manual process. Read the full breakdown →
