Authentication
Customer access uses Supabase Auth, server-side session checks, and protected dashboard routes.
Security
Designed for customer control and server-side trust.
GBPAutoFix handles sensitive business-profile workflows with authentication, tenant-aware authorization, signed provider events, and explicit customer approval checkpoints.
SessionsProtected routes and authenticated workspace access
Tenant contextOrganization membership resolved server-side
Evidence privacyPrivate storage access and requirement tracking
Billing controlsWebhook validation and portal authorization
Control layers
Real protections, described plainly.
The goal is to communicate what is actually implemented today: authentication, tenancy, billing integrity, event replay handling, scoped provider access, and redacted operations.
Tenant isolation
Customer work is scoped through tenant-derived authorization rather than trusting browser-supplied account identifiers.
Billing validation
Checkout uses server-side product and Price allowlisting, while webhooks validate Stripe signatures and event contracts.
Replay handling
Stripe event processing is designed around idempotency, duplicate detection, and stale lifecycle handling.
Least privilege
Google access uses OAuth scopes and avoids passwords, 2FA codes, browser sessions, or unsafe credential sharing.
Redacted operations
Security utilities support redaction of sensitive provider credentials in logs and diagnostics.
What we never ask for
No passwords. No shortcuts. No fabricated evidence.
We do not request Google passwords, two-factor codes, browser sessions, payment card numbers, or altered business records.
Security contact: Email Admin@GBPAutoFix.com. Do not include secrets or sensitive evidence in an initial report.