Security & privacy
Tenant boundaries backed by the server and the database.
NeighborNudge minimizes resident data, validates every mutation, and uses production services only when every required credential is configured.
Server-side authorization
Every protected read and mutation checks the signed-in staff user's assignment and role. Navigation visibility is not treated as authorization.
Supabase Row Level Security
Association-level policies protect residents, schedules, delivery records, branding, and audit data.
Signed resident links
Preference links expire, rotate after sensitive changes, and reveal only the recipient record tied to the token.
Suppression before send
Consent and suppression are rechecked immediately before each job. Hard bounces, complaints, and unsubscribes block future sends.
Production fails closed
Missing Supabase, Resend, signing, or cron credentials produce a clear operational error. The application never silently switches a production send to simulated delivery.