R's DocManager is built with security at every layer.

• Passwords are hashed with bcrypt before storage
• Sessions are managed with secure browser-side tokens
• Custom authentication system with no third-party dependencies

• Users join organizations using a unique alphanumeric Organization Code
• Membership requires explicit approval from a Super Admin
• Pending users cannot access the dashboard or any organization data
• Rejected users are blocked from logging in
• Organization codes can be regenerated by God-role users to prevent unauthorized access

AI provider API keys use AES-256-GCM encryption:

1. A random 12-byte initialization vector (IV) is generated per key
2. The key is encrypted with AES-256-GCM using a server-side secret
3. A 16-byte authentication tag verifies data integrity
4. The encrypted key, IV, and auth tag are stored together
5. Decryption happens in memory only when needed

• Documents can be individually password-protected
• Document passwords are hashed with bcrypt
• Only users with the correct password can view the content
• God-role users can bypass document passwords

• Each organization has completely isolated data
• Database queries enforce organization-level filtering for all roles except God
• Super Admin, Admin, and User roles can only access data within their organization
• Only God role has cross-organization access

• Document files stored in secure Supabase storage buckets (50 MB limit)
• User avatars stored separately (5 MB limit)
• Access policies enforced at the database level

All significant actions are logged: document changes, role changes, login events, and organization modifications.

• Pages — page-level permission rules, public-link safety, and audit events