Account

• Organisations, membership and roles — owner, admin and member, with row-level security enabled and forced on every table, written in the same migration that created them.
• Tenant isolation, proven in the database — not asserted in a document. Two tenants are seeded, the policies are exercised as the real signed-in role, and a leak aborts the deploy. Asking for another organisation’s row by id returns zero rows rather than an error, because an error would confirm it exists.
• Standing alerts on commercial criteria — hail size, distance from a base, and how many vehicles are underneath. The feature competitors cannot copy, because they do not know what is under the hail.
• Worked and dismissed storms — so the ranking never re-surfaces one the crew has already dealt with.

One rule worth knowing, because it is enforced by the database rather than promised by a screen: an alert can only ever page the person who created it. An owner cannot enrol their crew and a bug in a form cannot either. That is the single carve-out to this product’s nothing-leaves-the-building rule, and it is a constraint, not a policy.

Not built, deliberately. Price and tiers are a commercial decision, and inventing plan names now would mean either throwing them away or having them quietly become the product. There is no plan column in the schema for the same reason.