Tenant isolation by default
Every API request is scoped to a tenant UUID. Row-level filters and RBAC permissions are enforced before any CRM data is read or written.
Trust & security
Security is built in — not bolted on.
Sparo is a multi-tenant customer-operations platform. Every layer — from demo handoff links to AI write-actions — follows the same standard: least privilege, cryptographic verification where it matters, and automatic expiry for time-boxed access.
Signed, expiring demo access
Live product demos are gated behind HMAC-signed links with a fixed expiry. Sessions use httpOnly cookies and auto-revoke — keys are never left in the URL after the first visit.
Session & token hygiene
Auth sessions use signed JWTs with issuer, audience, and expiry checks. Public customer links (booking, estimates, feedback) use single-use HMAC tokens.
Governed AI write-actions
Agents propose changes; humans confirm before anything is persisted. AI answers for metrics are computed by deterministic SQL, not guessed by the model.
Transport & browser hardening
Production responses include HSTS, X-Content-Type-Options, frame controls, and a strict referrer policy on every page.
Full audit trail
Record creates, updates, and deletes are attributed to the acting user or agent. Enterprise deployments can extend this to SSO/SAML identity assertions.
Live demo access
The public site shows guided tours only. Real tenant demos require a private link with a signed, time-limited key. After the first visit the key is exchanged for an httpOnly session cookie that auto-expires — typically within seven days or sooner if the grant was shorter.
- Rotate
DEMO_ACCESS_SIGNING_SECRETto invalidate all outstanding links. - Set
DEMO_ACCESS_KEY_EXPIRES_ATto retire a static passphrase on a schedule. - Mint per-client links with
pnpm demo:access-link.