Appearance
Security & compliance
| Area | Posture |
|---|---|
| PCI | Vecnet never handles raw PAN. Card capture is delegated to the rail (Tonder Lite SDK v2.0 + Skyflow tokenization). Vecnet stores tokens/references only. Do not add any field that could hold a PAN. |
| RLS | RLS everywhere on finances tables; merchants scoped to their entity; writes via posting function / admin role only. |
| Secrets | Rail API keys, signing secrets in Supabase Vault / env — never in the repo, never in the client bundle. The rails and webhooks tables hold only Vault references. |
| Money integrity | Double-entry balance enforced (reject imbalanced postings); numeric storage; decimal library at boundaries; idempotency via constraints. |
| Gov data | Treat citizen/payer PII as sensitive; minimize what Vecnet stores (customer_ref is hashed, never raw email); encrypt at rest (Supabase default) and scope access. |
| Audit | Journals + ledger entries are the immutable audit trail; adjustments go through internal transfers with description + reference, never by mutating balances. Every operator config mutation writes audit_log. |
No PAN, ever
The single hardest line: no field anywhere in Vecnet may hold a raw PAN. Card data lives only inside the SDK + Skyflow. This is what keeps Vecnet out of PCI scope.