Security at CherryWorks Pro

Every row in our database is scoped to a single organization. Every query and mutation derives the organization ID from the authenticated session — never from request input. Cross-tenant reads and writes are architecturally impossible.

Invoice totals, discounts, tax, and payment status are computed deterministically and re-verifiable on demand. Once an invoice is sent, edits create immutable revision snapshots — the original is never silently mutated. Every financial mutation is written to an audit log.

Stripe integration uses signature-verified webhooks (constructEvent against STRIPE_WEBHOOK_SECRET). Payment receipts are reconciled idempotently. Refunds reconcile atomically against the original charge. We never see or store full card numbers.

HttpOnly session cookies with sameSite=lax and the secure flag in production. CSRF protection with double-submit tokens on every mutating request. Bcrypt password hashing. Optional TOTP and WebAuthn multi-factor authentication, persisted to the database.

Per-route rate limits on login, signup, password reset, public invoice tokens, payments, imports, payroll webhooks, and settings changes. Per-tenant token-bucket limiter on top of per-IP and per-user limits.

Public invoice tokens use 256 bits of cryptographic entropy (randomBytes(32)). Each invoice has its own token. Tokens can be revoked.

Every financial and workflow mutation — invoice send, invoice revision, payment apply, payment refund, payout, timesheet transition, MFA change, import run, year-end close — is written to an append-only audit log scoped to your organization.

All traffic is HTTPS. PII is masked in application logs. We do not sell or share customer data with third parties.

On the Business plan, Marketing Hub is included: marketing prospects and marketing companies live in physically separate database tables (marketing_prospects, marketing_companies) from your billing clients. No foreign keys cross that boundary, so a marketing lead cannot be silently invoiced or reported on as a client. Promoting a prospect to a billing client is an explicit, audited action — never an automatic side effect. This prevents cross-contamination between marketing and billing records by design.