Access boundaries are part of the product.
Access is verified after sign-in, not assumed before it. Here is how it works, in plain English.
Boundaries built in, not bolted on.
Authentication and authorization are not the same thing.
Signing in proves who you are. It never decides what you are allowed to see or do.
Authentication — who you are
Access is invite-based. You sign in with email and password, or with Microsoft or Google when your organization enables single sign-on. Choosing a login type is only a convenience; it grants nothing.
Authorization — what you can do
After you sign in, your organization, role, and relationships determine exactly what you can see and do. Pick the wrong login type and you are still routed by your real role and tenant permissions.
Protections that apply everywhere in ValoraFlow.
The same access, isolation, and auditability guarantees hold across every lane.
Invite-first access
Accounts are provisioned by invitation, never open self-signup.
Tenant isolation
Every organization's data is isolated from every other tenant.
Role-based authorization
What you can see and do is bound to your role and relationships.
Row-level security
Isolation is enforced in the database, not just the interface.
No PHI in operational surfaces
Health data never appears in normal broker, IMO, or carrier views.
Audit events
Sensitive reads and financial actions are recorded.
Secure uploads
File submissions are validated and handled on the server, not the browser.
Scoped partner access
Broker-scoped and carrier-scoped access keep partners in their lane.
Carrier credential protection
Carrier credentials are handled server-side and never exposed.