Security

Designed for trust, built for control.

DELT is architected so that access, files and payments are protected at the data layer — not just in the interface.

Verified access

Clients access deals through a private link plus email verification via OTP. No unguessable URL is treated as a security boundary on its own.

Private file storage

Deliverables are stored in private buckets, not public URLs. Access is authorized per deal participant and delivered through signed URLs.

Payment-aware delivery

Files remain locked until payment is confirmed server-side. The client cannot unlock deliverables through frontend state alone.

Participant-based access

Only the creator and the invited client can access a deal workspace. Authorization is enforced at the data layer, not by hiding buttons.

Full audit trail

Every action — from deal creation to file upload to payment — is logged as an immutable event in the activity timeline.

Secure by architecture

Row-level security, server-side validation, and signed URLs are designed into the data model from day one, not bolted on later.

What we do not do

We do not rely on hiding buttons for authorization.

We do not trust client-side payment state as confirmation.

We do not expose private files through public URLs.

We do not use predictable IDs as access credentials.

We do not store service-role credentials in the browser.

DELT is designed for clean integration with Supabase Auth, RLS, private storage buckets and signed URLs. Backend enforcement will be activated when the database layer is connected.