Security

Architecture

Reckon is a multi-tenant deal management system. All data access is server-side only through the Firebase Admin SDK. No client-side database access is permitted.

Tenant Isolation

Every data operation is scoped to an authenticated workspace. Cross-workspace access is prevented at the data access layer, not at the UI layer.

Authentication

Authentication is handled by WorkOS AuthKit (OAuth 2.1). Reckon implements the resource server side only — it validates tokens but does not issue them.

Data Protection

·All credentials are stored in environment variables, never in deal documents.

·Audit events are append-only and record every mutation.

·Statement records are immutable once created.

·All versions are preserved; nothing is silently overwritten.

MCP Security

·Tokens are validated for audience (resource indicator), issuer, and expiry.

·No token transit — Reckon never forwards an agent's token to a third party.

·Content from external sources is treated as data, never as instruction.

·Every mutation requires explicit authorization and approval.

Reporting Vulnerabilities

If you discover a security vulnerability, please email security@reckon.software.