ExpenseMargin uses layered application, database, storage, and operational controls.
Organization data is protected with Supabase Row Level Security so authenticated users only access authorized workspaces.
Uploaded invoices are stored in a private Supabase Storage bucket and are not published as public assets.
Service-role, OpenAI, Stripe, Resend, and cron credentials are used only in server-side runtime paths.
Sensitive product, billing, settings, invoice, and data-export events are recorded in tenant-scoped audit history.
Production traffic is served over HTTPS with HSTS, frame protection, content-type protection, and a restrictive referrer policy.
AI is used for invoice understanding; financial comparisons and margin-impact calculations remain deterministic application logic.