13. Security

Orbit will apply security controls in its FastAPI backend and PostgreSQL database, shared by the React web interface and the planned React Native application.Protected endpoints will require authenticated identities. The backend will validate permissions and tenant membership on every request, including access to individual client records. Access will be denied unless explicitly permitted. Frontend controls will support the interface, while authorization will remain enforced by the backend. AI agents will receive scoped access to the client context needed for their assigned work. Separate database permissions will prevent agents from directly inserting, updating or deleting client, task and document records. Agents will submit validated ProposedChange records through the proposal API. The reconciliation workflow will evaluate these proposals, and conflicting changes will require advisor review before application. Deployed connections will use HTTPS. Google Calendar credentials will be encrypted at rest, with encryption keys and other secrets kept outside source control and frontend bundles. Logs will exclude access tokens, booking-management tokens and unnecessary client information. Initial development and demonstrations will use synthetic client data. Public availability responses will expose available time intervals without private event details. Booking-management tokens will be signed, expire, and grant access only to the specified booking and permitted actions. The backend will validate their signature, expiry and scope. Public booking and authentication endpoints will have request limits to reduce abuse. FastAPI request models will validate input types, lengths and allowed values. Database operations will use parameterized queries. AI-generated proposals will also be validated. Before selecting an external AI provider, the team will evaluate what client data would leave Orbit and the provider’s retention practices. Significant mutations, proposals and approval decisions will record the actor, timestamp, affected resource and state changes.