Tenant boundary
Tenant identity is resolved through trusted server-side infrastructure and used to scope tenant-owned data.
Security and privacy
Trust is a product boundary, not a footer promise.
OneCRM's Constitution does not allow security, privacy, tenant isolation, auditability or customer data ownership to be traded for speed or feature breadth.
Implemented foundation
Verified development foundations
These are architecture and implementation facts, not a production certification or service guarantee. Each production environment must still prove its complete trust path.
Least privilege
Tenant-scoped roles and permissions use deny-by-default authorization; UI visibility is not treated as security.
Auditability
Security-relevant user, role, permission and tenant-management changes create durable audit evidence.
Human accountability
AI and automation must respect existing authorization and retain responsible human control for consequential work.
Data ownership
Customer ownership, portability and provider neutrality are constitutional design principles.
Production verification
DNS, TLS, proxy trust, regions, providers, backups and operational controls remain deployment-specific gates.
Confirmed principle
Separate tenant and organisation
A tenant is the SaaS security and data-isolation boundary. An organisation is a legal or operating company within that tenant. This allows business structures to evolve without weakening the tenant boundary.
Open production decisions
Hosting, residency and service commitments
Providers, regions, cross-border processing, encryption and backup commitments, certifications, service levels and final privacy wording are not approved for definitive public claims.
Final legal and privacy language requires qualified review before production publication.
Transparent by design
Evaluate the product direction and its current evidence separately.
The platform overview keeps implemented foundations, planned capabilities and long-term vision visibly distinct.