© 2026 BX1X
Security & Access Control
Three layers of protection.
Zero compromise.
Identity, authorisation, and guardrails — working together so the right people access the right data, and every action is recorded.
Defence in depth
Security isn't a feature — it's three independent layers that work together. Even if one is bypassed, the others hold.
Layer 1
Identity context
Secure authentication with session management, token lifecycle, and rate-limited login protection. Every session knows who you are, which organisation you belong to, and what role you hold.
Layer 2
Authorisation
Role-based access control with 30+ permission types enforced on every route and action. Permissions are checked before any data is read or written — not after.
Layer 3
Experience guardrails
The interface adapts to your role. Controls you can't use don't appear. Actions you're not authorised for aren't offered. No error messages — just a clean, relevant experience.
Beyond access control
Security extends to data isolation, encryption, audit logging, and organisation management.
Audit trails
Every action — create, update, delete, access — is logged with who, what, when, and from where. Compliance-ready, filterable, and searchable.
Multi-tenant isolation
Data is isolated between organisations at the database level. One organisation's data is never accessible to another, regardless of user role.
Data encryption
Sensitive data is encrypted at rest and in transit. Payment credentials use AES-256-GCM encryption. Tokens are hashed before storage.
Organisation management
Create organisations, manage members, assign roles, and control access — all from an administrative interface with full audit logging.
Why it matters
Every action is logged — who did what, when, and from where — ready for compliance review
Permissions are enforced before data is accessed, not after — no data leaks from UI-only restrictions
Multi-tenant data isolation ensures one organisation's data is never visible to another
Role-based access means team members see only what's relevant to their function
Destructive actions always require explicit confirmation — no single-click deletions
Rate limiting protects against brute-force attacks on authentication endpoints
Medical data (PHI) has additional access controls beyond standard permissions
Related features
See security in action
Book a demo and we'll show you role-based access, audit trails, permission enforcement, and multi-tenant isolation — all live.