Identity before execution
Protected backend actions identify the principal, validate installation or license state, check backend entitlement, verify quota, and only then allow execution.
Security & trust
Security built around controlled access and traceable execution.
Ease uses scoped identity, cloud-managed infrastructure, explicit entitlement checks, and operational traceability to protect reporting workflows.
Explicit workspace membership
Team access requires a named, verified membership and an available seat. Ease does not grant workspace access because a user shares an email domain with the purchaser.
Scoped source access
Connections use provider authorization mechanisms and requested scopes. Users can disconnect sources and revoke provider access independently.
Cloud isolation
API and worker responsibilities are separated. Asynchronous jobs are dispatched through a controlled queue, while internal workers are not exposed as public user endpoints.
Protected data in transit
Public service traffic uses HTTPS. Google Cloud services provide encryption in transit and at rest; sensitive configuration belongs in managed secret storage.
Traceability
Run identifiers, state transitions, entitlement decisions, and operational events support investigation and troubleshooting without relying on spreadsheet output alone.
Data minimization
Firestore is used for metadata, status, pointers, and small records. Cloud Storage is reserved for larger artifacts and optional archived report versions.
AI responsibility
AI does not replace source-of-truth reporting.
Forecast Builder produces deterministic calculations. AI Analysis and Explain this forecast are separate actions that produce interpretive output.
Users should validate AI-generated commentary before relying on it for financial, budget, or campaign decisions. AI output can be incomplete or incorrect even when the underlying report is accurate.
Request is authenticatedIdentity and context are validated
ControlEntitlement is evaluatedPlan, scope, trial, exception, and quota
ControlExecution is recordedStatus and trace identifiers support operations
TraceOutput boundary is labeledDeterministic or interpretive result
ClarityReport a concern
Security communication
If you believe you found a vulnerability or unauthorized access, do not include live credentials, access tokens, or sensitive customer data in your first message.