Built for financial source documents, from the ground up.
A receipt or a transaction record is a legal and financial document. This is the architecture behind how Verluma Entry treats that — not a retrofit.
No public receipt URLs
Every document is streamed through an authenticated route that independently re-verifies the caller's session, workspace membership, and permission on every single request — not once at upload time.
Private object storage architecture
Receipt files are designed to live in a private, S3-compatible object storage bucket with public access blocked at the infrastructure level — never a signed or time-limited public URL. The application always proxies bytes through its own authenticated route, regardless of where the underlying bytes are stored.
Encrypted transport
Production traffic runs over HTTPS end to end. There is no unencrypted path between a browser and the application in production.
Workspace isolation
Every record — client, receipt, transaction, category — is scoped to its workspace at the database layer. There is no cross-tenant query path, admin override, or 'view all workspaces' mode anywhere in the system.
Server-side authorization, always
What a role can do is enforced on the server, on every request, for every action — never inferred from what a hidden button implies. A hidden menu item is a UX nicety here, never the security boundary.
Per-record access, where it matters
Transaction access isn't just workspace-wide — Staff members can only reach the transactions they themselves entered, checked on every read and write, not just at the list level.
Review separation
The person who enters or materially edits a transaction can never approve it themselves. Every status change is recorded in a permanent, append-only history.
Password lifecycle
Passwords are hashed, never logged or stored in plaintext anywhere — including audit records. New accounts use a one-time temporary password and must choose their own on first sign-in.
Append-only audit trail
Uploads, edits, review decisions, and exports are all recorded. There is no update or delete path for an audit entry, for any role.
Verluma Entry has not undergone a formal third-party penetration test or a compliance certification such as SOC 2 or ISO 27001. It is architected around the same principles those frameworks require — but we won't claim a certification that doesn't exist.
Production receipt storage runs against a private, S3-compatible bucket — the application refuses to even start in production with local-disk storage configured, so this isn't a claim we could get away with making if it weren't true.