Access decided by the server — not hidden by the screen.
Who may see and change what is part of the model and is enforced where the data lives. A field a person may not read never reaches their browser; a record from another organisation does not exist as far as they can tell.
Least privilege, by default.
- Roles carry explicit actions — read, create, update, delete, import, export, configure, administer.
- Record access per object — all records, their own, records they own, their team’s, or none.
- Restricted fields — removed by the server before the response is written.
- A job title is not a role — broad read access never confers administrative power; only the owner administers.
- Portal members get nothing from an organisation role, so a forgotten check cannot grant access.
Every change, by whom — including the automations.
Record changes, stage moves, approvals, generated documents and workflow runs are written to an audit chain. Each entry is linked to the one before it, so an operator can verify that nothing was altered or removed after the fact.
When an automation acts, the trail says so — “automatically, by the approval workflow” — rather than attributing it to the last person who touched the record.
The controls an enterprise buyer asks about.
Structural tenant isolation
The organisation is part of every query’s context and is never taken from the request body. Another organisation’s record answers “not found”, never “forbidden”.
Identity
OIDC single sign-on, SAML, SCIM provisioning, multi-factor authentication and master-key rotation.
API keys with scopes
Keys carry explicit scopes and cannot mint other keys. Webhooks are signed over timestamp and body.
Promotion and rollback
Configuration moves between environments without data or secrets, and every deployment can be rolled back to the configuration it replaced.
Governed AI
AI is off until an administrator registers a provider and model, with a monthly budget, per-call metering and a limit on concurrent calls.
Person-only publishing
An assistant may propose a change to the model; only a person can publish it.
Tavuni has no third-party security certification (such as SOC 2 or ISO 27001) and has not been independently penetration-tested. These controls are verified by the product’s own automated tests.
See it work on a real workbook, in your browser.
The example operations workbook opens in Tavuni with no account and nothing uploaded. Every number on this site comes from that same pipeline.