Cannvas holds the operating record of licensed cannabis businesses — so security is built into how the platform is constructed and shipped, not bolted on after. This page is the real posture: what isolates your data, what watches the platform, and how to reach us. No badge theater — mechanisms, published.
Cannvas is multi-tenant with isolation enforced at the database, the service layer, and the session — three independent walls, each of which would have to fail before one organization could see another’s data.
Every security signal is either a deploy-blocker — caught before it ships — or a push alert on what’s new — caught before it festers. Nothing depends on someone remembering to check a dashboard.
And the net grows. Every incident or near-miss becomes a permanent, mechanical guardrail — a new deploy-blocking check or a new sweep probe — so the same class of mistake can’t ship twice.
Every model call in Cannvas passes through one gate. It carries a platform-wide daily ceiling, a per-organization ceiling, and a ledger row — who asked, which surface, how much, how long — with alerts at 80% and at the cap. Over the cap, the caller gets a plain message, not a surprise invoice. The anonymous surfaces (a customer’s taste match, a panelist’s score) add per-device caps and per-address rate limits on top, and every public write on the platform is rate-limited by construction — the deploy gate refuses a new one that isn’t.
Platform cap per day, organization cap per day, inside the single function every model call uses. A lint fails the deploy if any code path goes around it.
Organization, caller, actor, model, outcome, input size, latency — one row per call, so spend is read from records, never estimated.
The model writes the sentence; the engines compute every number. A figure the engine did not produce is withheld — the AI cannot be talked into inventing one.
Every AI surface says what the model did and did not do, in the sentence beside the control; expert panel weight comes only from devices the organization enrolled.
The platform runs on Cloudflare’s edge network and Supabase-managed Postgres — infrastructure with its own audited security programs underneath ours.
Report suspected vulnerabilities to [email protected] with “Security disclosure” in the subject. Good-faith research against your own account’s data is welcome; we’ll acknowledge, investigate, and tell you what we found. Please don’t access other tenants’ data, degrade the service, or retain data you weren’t meant to see — the full rules live in the Acceptable Use Policy.