Built multi-tenant from the first table

Every record — users, locations, JSAs, revisions, acknowledgements, audit logs — is scoped to a company and enforced at the database level with row level security. A user in one company cannot read or write another company's data.

Company Owner, Safety Manager, Supervisor, Employee and View Only. Creation, editing and approval rights are enforced server-side, not only in the interface.

Approved documents are shared through a non-guessable token, never a sequential ID. Tokens can be revoked; a revoked document shows 'This safety document is no longer active.'

AI provider keys and privileged credentials are only used in server-side code. They are never shipped to the browser and never appear in generated PDFs.

Logins, document creation, edits, submissions, approvals, downloads and acknowledgements are recorded. Ordinary users cannot modify audit entries.

Company logos, SDS files, uploads and generated PDFs are stored in private buckets and served through short-lived signed URLs where appropriate.