Security built into the ownership layer.

• Data lives in a managed PostgreSQL database with row-level security enabled on application tables.
• Isolation is enforced by the database itself, so a client request cannot reach another tenant's rows even if the interface asks for them.
• Company, investor and partner workspaces are separated: one identity can hold several workspaces, and each read resolves against the active workspace only.

• Authenticated sessions with per-workspace membership.
• A role and permission model checked server-side through a security-definer function, never from client state.
• Private documents are tenant-scoped and readable only with the relevant permission.
• Sensitive actions are recorded in audit trails.

Nothing outside an authorised, human-approved workflow can change the ownership ledger.

• AI proposals are inert records. They become nothing until a permitted user approves them.
• The authoritative ledger is kept structurally separate from AI features.
• A partner action in the partner portal can never directly mutate the ownership ledger.
• Confirming settlement in a secondary workflow does not itself move ownership; the transfer is recorded through the normal ledger flow.
• Companies control disclosure: what an investor or counterparty sees is a projection under the company's settings, not access to the cap table.

• Invitation tokens are stored hashed, never in plain text.
• Invitations expire, are single-use, and can be revoked at any time.
• Claiming happens through a server-side function that reveals nothing about an invitation to an unauthorised caller.
• Where an invitation is bound to an email address, that binding is checked on claim.

• The payment integration runs server-side only.
• Incoming billing webhooks are signature-verified before anything is processed.
• Billing events are idempotent, so a replayed event cannot double-apply.
• Payments are authoritative at the provider; entitlements are resolved by Perseids from the active workspace's subscription.

• All traffic is served over encrypted HTTPS.
• Service-role and provider credentials are held server-side and are never exposed to the browser bundle.
• Server-only modules are blocked from client builds at the bundler level.

We describe controls we actually operate. Perseids does not currently hold ISO 27001 certification, a SOC 2 report, a GDPR certification or a published penetration-test certification, and we will not imply otherwise. When that changes, this page will say so with the report available on request.

If you believe you have found a vulnerability, email security@perseids.ai with enough detail to reproduce it. Please give us a reasonable opportunity to investigate before public disclosure, and do not access, modify or exfiltrate data that is not yours. We will acknowledge reports and keep you updated on remediation.