Company isolation is enforced in the database
Each tenant-owned table carries the company boundary. PostgreSQL row-level security is enabled and forced, and company work runs inside a transaction-scoped company context using a non-owner role. This makes tenant isolation a database rule, not only a filter in the interface.
Authentication answers who signed in. Authorization separately decides what that person may view, prepare, approve, post, export, or administer. Hiding a button is never treated as sufficient permission control.
AI drafts; authorized people decide
Maya can run read tools and create stored proposals. Write tools do not bypass the approval workflow. Approval re-validates the stored payload under the company scope and applies the action as the human reviewer, with proposal and actor provenance.
Accounting entries still pass through the same domain validation and single ledger posting gate used by the rest of FiscalOS. Voice and chat do not receive a separate shortcut.
History and evidence remain inspectable
Posted journal history is append-only and corrected through linked reversals. Audit events preserve material actors and actions outside the ledger. Source attachments are size-capped, validated by type and file signature, tenant-scoped, checksum-addressed, and stored outside immutable application releases.
A missing attachment is reported as an evidence gap, not rewritten as an accounting failure and not concealed by a confident AI answer.
External access stays narrow
Long-lived provider credentials remain on the server and protected fields use authenticated encryption. Live Gemini voice uses a short-lived, constrained ephemeral token rather than exposing the long-lived API key to the browser. Provider callbacks and webhooks are signature-checked and replay-protected on their exact routes.
A provider connection can supply data to a review workflow, but it cannot post directly to the ledger. Credential-dependent features remain unavailable when their production configuration is incomplete.
What this page does not claim
These are implemented product controls, not a claim of a certification, a guarantee against every incident, or a substitute for a customer’s own access, device, retention, and review practices. FiscalOS does not publish secrets, infrastructure addresses, token material, or private operational details as proof of security.
Sources and references
Check the source behind the explanation.
- FiscalOS accounting methodology
How documents, approval, posting, correction, and reporting fit together.
- FiscalOS editorial methodology
How public product and financial claims are checked.
- Contact FiscalOS
Ask a product, privacy, or security question.
External sources are linked for verification. A citation supports the general explanation; it does not account for facts that have not been supplied or reviewed.