Our security posture, stated plainly.

Every stock movement and its ledger entry are written in one atomic transaction. The ledger reconciles — exactly.

migration 077 — fn_write_stock_movement(). The function locks the stock row, re-checks the guard against the locked value, and writes the level and the ledger entry together. Application code cannot write a stock level directly: an invariant scan in the deploy gate fails the build if it tries.

When the network or the AI fails, the system prints a paper slip and never traps your staff. It fails toward paper — loudly.

The slip is a real printable PDF carrying the indent number, ward, per-line quantities and signature lines — the same slip a paper-only hospital already trusts. "Loudly" is enforced: a queued message is not a delivered one, so the interface shows the print-the-slip notice whenever the signal leg has not actually reached the recipient. Proven in a browser with the signal leg dead, on a scratch tenant.

HMAC-verified webhooks on both external message entry points.

Both inbound routes — the WhatsApp webhook and the voice webhook — recompute Twilio’s HMAC-SHA1 signature over the request and compare it before the message is acted on. A request that fails the comparison is rejected with 403. See the note opposite on what happens when the signing key is not configured.

Scratch-tenant isolation for all testing; protected production identities.

Automated tests write only to scratch tenants numbered 9000 and above and tear themselves down afterwards. A guard suite in the deploy gate rejects any teardown whose scope could reach a real tenant.

SOC 2 and ISO 27001: not yet — on the roadmap. We’d rather tell you that than pretend.

Independent third-party audit: planned post-pilot.

Webhook signature checking is not fail-closed everywhere. The WhatsApp webhook verifies Twilio’s signature only when the signing key is configured — if that one setting is missing it logs a warning and accepts the message anyway. The voice webhook does not have this hole, and neither does our cross-tenant isolation gate, which blocks a push when it cannot reach the database it tests. Making this one match them is open work, and it is ours, not a roadmap item.