$ fireit --explain security

Trust is table stakes.

No cinematic security theater. Every guardrail below is enforced in code and reviewable in migrations — written like a spec.

fireit-security-trace · live
  1. 00:00.001[TENANT]row.read organization_id=? policy=is_org_member → allow
  2. 00:00.012[WEBHOOK]hmac.verify sha256 timing-safe · ts.age=3s < 300s → accept
  3. 00:00.018[IDEMPO]webhook_events UNIQUE(provider,event_id) → dedupe ok
  4. 00:00.024[SECRET]process.env.PROVIDER_KEY read inside handler → never bundled
  5. 00:00.031[AUDIT]audit_logs append actor=owner action=role.grant → immutable
  6. 00:00.037[AUDIT]admin.audit append-only · logAudit throws on write failure
Guarantees · 06

Written like a spec.

Each item maps to an actual policy, migration, or handler you could review.

  1. Tenant isolation

    Every row carries organization_id (and where relevant, location_id). RLS enforces membership and role checks on every read and write, on top of role-scoped GRANTs.

  2. Order integrity

    Order writes are tenant-scoped and idempotent. Provider webhooks are deduplicated by (provider, event_id) with a UNIQUE constraint. State transitions are immutable events.

  3. Secrets isolation

    Voice, POS, payments, SMS, and email adapter interfaces live behind server-only boundaries. Secrets are read inside handlers — never at module scope — and never bundled into the client.

  4. Signed webhooks

    Every inbound webhook is HMAC-verified with a timing-safe compare, rejected on missing or expired timestamps, and stored raw before processing so redelivery is a no-op.

  5. Audit trail

    All privileged actions — org creation, role grants, order overrides, sales-agent drafts and approvals — land in an append-only audit log accessible to owners and platform admins.

  6. Emergency pause

    Once your voice line is live with Fire It, owners and platform admins can pause it from the dashboard; incoming calls roll to voicemail or a transfer number until pause is lifted.

Things we don't do

The honest list.

  • ✗We do not claim perfect accuracy. When voice ordering is live for you, every confirmed order goes through authoritative acknowledgment before the caller hears “you're all set.”
  • ✗We do not fabricate POS or provider live connectivity. Integrations show awaiting configuration, planned, or pilot until proven end-to-end.
  • ✗We do not cache authenticated data in the browser service worker. Anything behind sign-in is always network-fresh.
  • ✗We do not use one privileged database key for public reads. Anonymous requests hit a narrow publishable path with RLS as anon.

Have a security question?

DPAs, subprocessor lists, penetration test summaries — reach out.

Contact UsPrivacy policy