Security architecture

Deliberate access boundaries.

Freelancer workspace

Clerk authenticates freelancer accounts. Dashboard and workspace routes require authentication.

A client portal uses separate capability-based access and portal sessions. Clients are not required to have a freelancer account.

The web backend-for-frontend enforces authenticated workspace access before forwarding requests to the service API.

Architecture description only. This is not a security certification or a legally approved privacy policy.