Tenant isolation
Organization boundaries are enforced at the database and service layers, with tests proving customers cannot cross those boundaries.
Protect the data behind every cost decision.
Bills and contracts reveal sensitive operational details. Costivra keeps customer data separated, documents private, permissions narrow, and consequential actions under explicit approval.
DocumentOrganizationPolicyApproval
Controls should be visible in the workflow, not buried in a promise.
Access, authority, and accountability are separate layers. That means a file cannot create permission, and permission cannot silently become an external action.
Private documents
Original files stay in private storage and use short-lived signed access. Sensitive identifiers are masked when full display is unnecessary.
Least privilege
Users, services, agents, and integrations receive narrow permissions for the organization, resource, and action they need.
Human authorization
Consequential external actions require the configured approvals. Bank and payment instructions cannot be changed autonomously.
Complete provenance
Corrections preserve the original extraction, editor, timestamp, reason, and evidence reference.
Untrusted content defense
Instructions found inside documents, email, or OCR text are treated as data and cannot change policy or expand tool access.
A deliberate first step
Contact Costivra Bring your security questions to the product, not a sales script.
Use the contact channel for a specific workflow or data-handling question. We will be clear about what exists today and what is still planned.