Security before features: keeping every business's data its own

B2B Brain holds many businesses' customer data in one system. The most important property it has is that those businesses stay completely separate.

What we test, every time

• One business cannot read another's customers, leads, quotes, jobs or notes.
• One business cannot attach its records to another business's customer, quote or staff member — even by guessing an ID.
• Read-only roles cannot write anything.
• Every activity entry and note records the real person who did it; nobody can put words in someone else's name.
• Multi-step actions, like accepting a quote and winning the lead, either complete fully or not at all.

These checks run as hundreds of automated tests against the real database schema, attacking in both directions between two test businesses, on every change.

“The feature list can wait a week. Trust can't be added later.”