Multi-tenant, and built like it matters

Tenant isolation is the spine

Every Fieldcurve organization is a hard boundary. Every tenant-scoped row carries the organization id, and PostgreSQL row-level security enforces the boundary at the database — beneath the application code, so an application bug cannot become a data leak.

Cross-tenant isolation is not a policy document; it is an automated test gate. Every change runs a suite that attempts cross-organization reads and writes through the real API surface and fails the build on any leak — including probes that merely confirm another tenant's records exist.

Access is scoped, deny-by-default

Roles are named bundles of capabilities your organization defines, granted at a scope: the whole org, one group (a business unit like a region), or one project. A user in the CSU group who should only see Project A sees only Project A — dashboards, search, exports, everything reads through the same access predicate.

Task assignment is a responsibility marker, never an access grant: being handed a task presupposes access, it doesn't create it.

History that answers the auditor

Status, percent, assignment, permission, and structural changes are written to an append-only audit ledger: who, what, before, after, when. Comments are append-only by design — corrections are new entries, so the record never rewrites itself.

Forgiving by design, not destructive

Deletes are soft: removing a milestone or task tombstones it and offers Undo, and rollups recompute in the same transaction either way. Destructive confirmation dialogs are replaced by reversible actions — safer for data and faster for the crew.

Controlled data in, clean data out

Excel imports are planned as a dry-run diff — creates, updates, conflicts, and warnings shown row by row — and commit in a single transaction only on confirmation, under the same permission checks as any edit. Exports are board-clean workbooks matching your template.

Identity & enterprise controls

Accounts are provisioned by your organization's admins — there is no open self-serve sign-up. Enterprise SSO (SAML) and SCIM provisioning are available on enterprise plans, alongside dedicated-instance deployment for programs that require it.