Security and secret boundaries

Browser, regional API, configuration, AI, databases, and providers as separate trust zones.

Zones

Browser uses protected session and CSRF controls.
Regional API validates workspace and permission.
Service calls use separate machine identity.
Control, marketplace, and AI data stores are separated.
Provider secrets stay out of client code and logs.

Minimization

Every zone receives only the required data and operation. Network reachability is not permission to read another customer's data.

A note on availability

Features depend on plan, role, connected marketplace, and data readiness. ProfitVena does not replace primary marketplace statements or regulated accounting and legal records.

Security and secret boundaries

Zones

Minimization

Related documentation