Tenant isolation — implemented
Workspace-scoped relational data is isolated with PostgreSQL row-level security. The application runtime role cannot bypass those policies. Migration, runtime and billing-worker roles are separated. Access decisions are re-evaluated per request.
Identity and privileged access — implemented
Authentication is delegated; Haulbi does not store user passwords. MFA is available. Session records store token hashes. Staff access is scoped, time-limited, recorded and revocable by the customer, with strong authentication required for operators.
Transport and application integrity — implemented
Transport is protected with TLS. The application has structured logs with correlation identifiers and key-based redaction. Idempotency and an action ledger reduce duplicate effects on retries. Code changes pass type, lint and test gates; deployment controls should be confirmed against the current environment.
Controls under verification
Encryption at rest, backup and restore procedures, monitoring and paging, incident-response runbooks, business continuity and penetration testing are not asserted here as completed controls. They must be verified and documented before they are included in a customer security annex.