How Ajaa protects workspace data
Ajaa is built as a multi-tenant service, with security checks applied at the workspace, document, and payment boundaries.
Tenant isolation
Authenticated actions verify that tenant-owned records belong to the caller's current business before reading or changing them.
Account and payment safety
Account mutations use anti-forgery validation. Paid access is activated only from verified, idempotently processed provider events—not browser redirect data.
Data handling
Secrets stay outside committed configuration, sensitive financial and personal fields use the existing protected storage path, and public document-link hardening remains tracked before general release.