Security and data principles

Principle	How the system applies it	Why it matters
Server-side permissions	Every page and action checks project, department and role on the server	Rights cannot be bypassed by editing a URL or calling the API
QR codes carry no rights	Only project, type, reference and an HMAC signature; access decided at each scan	A lost or photographed label exposes nothing
Segregation of duties	Reporter ≠ QC approver; installer ≠ acceptor; IT ≠ QC	Independent quality control, as standards require
History is never overwritten	Append-only records; corrections keep old / new value, person and reason; deletion only marks	Every change can be traced
Released documents are immutable	Final PKLs, approved weld revisions and handover packages are snapshots with SHA-256	Clients receive exactly the approved version
Optimistic locking & de-duplication	Second editor asked to reload; scans and uploads carry an idempotency key	No lost edits, no double records
Everything shared outside is filtered	Client copies and links contain only released, published data – no names, remarks, QC details or prices	Professional sharing without leaks
Storage, backup, migration	Write locks, atomic writes, automatic backups, dry-run migrations with rollback; data folder blocked from the web	Safe upgrades and recovery
Data sent to AI	API key encrypted (AES-256-GCM), never sent to the browser; only label templates are translated; human review required	AI help without sending client data

See also