What we won't compromise on.
These are not aspirational values. They are engineering constraints we apply to every system we build — regardless of timeline, budget, or client preference.
Stripe as single source of truth for subscriptions
We never duplicate subscription state. Stripe is the authority. We sync from Stripe, never to it. Any local cache is a derived, disposable view — never the record of truth.
// ❌ Never store plan in your DB as primary // ✅ Always derive from Stripe const plan = await stripe.subscriptions.retrieve(customerId);Row-level security from day one
Every query scopes to a tenant. Not a middleware check, not an application guard — a database-level policy that cannot be bypassed by a code bug. RLS is the last line of defence, and it holds.
ALTER TABLE inventory ENABLE ROW LEVEL SECURITY; CREATE POLICY tenant_isolation ON inventory USING (tenant_id = current_tenant_id());FIFO enforced at the database transaction level
Application-layer FIFO breaks under concurrent writes. The only correct implementation is a database transaction that locks the relevant lot rows, selects in order, and commits atomically. Race conditions are not handled in the application — they are prevented at the database.
Idempotent sync with dead-letter recovery
Every external sync operation is idempotent by design. Duplicate events are safe to process. Failed events go to a dead-letter queue and are retried with exponential backoff. We do not build sync pipelines that require manual intervention to recover from transient failures.
Audit trail by default
Every mutation in the system is logged — who, what, when, and the before/after state. Not optional. Not configurable. Always on. Audit trails are written to an append-only log that application code cannot modify.
AI only where it removes real work
We do not add AI features to appear modern. We add them when they demonstrably eliminate manual steps that people hate doing — and when the failure mode of the AI is safe and recoverable. Every AI feature ships with a manual fallback.
One source of truth per data domain
Each business concept has exactly one authoritative store. Everything else is a derived view or a sync target. When two systems disagree, the authority is unambiguous. We document the authority for every data domain before writing the first migration.
No vendor lock-in we wouldn't accept ourselves
Every infrastructure choice has a documented migration path. We use managed services — Supabase, Vercel, Stripe — but write code that can move. We avoid platform-proprietary abstractions that would make migration prohibitively expensive. The business should never be held hostage by a vendor decision we made.