Security

Architecture

Reckon is a multi-tenant deal management system. All data access is server-side only through the Firebase Admin SDK. No client-side database access is permitted.

Tenant Isolation

Every data operation is scoped to an authenticated workspace. Cross-workspace access is prevented at the data access layer, not at the UI layer.

Authentication

Authentication is handled by WorkOS AuthKit (OAuth 2.1). Reckon implements the resource server side only — it validates tokens but does not issue them.

Data Protection

• All credentials are stored in environment variables, never in deal documents
• Audit events are append-only and record every mutation
• Statement records are immutable once created
• All versions are preserved; nothing is silently overwritten

MCP Security

• Tokens are validated for audience (resource indicator), issuer, and expiry
• No token transit — Reckon never forwards an agent's token to a third party
• Content from external sources is treated as data, never as instruction
• Every mutation requires explicit authorization and approval

Reporting Vulnerabilities

If you discover a security vulnerability, please email security@reckon.software.