This page documents the primary domain entities. For schema definitions, see the migration files in the Core API repo.
Core entities
User
Represents an authenticated person. One user can belong to multiple organizations.
Organization
A company or team account. The primary billing and access control boundary.
Membership
Junction table linking users to organizations with a role.
Relationships
A user can be a member of many organizations. An organization can have many members. The Membership table holds the role for each pair.
Data storage
Sensitive fields
The following fields are encrypted at rest and must never appear in logs:
User.password_hash- Payment method tokens (stored in your payment processor, referenced by ID only)
- Any field containing PII in audit logs
If you’re adding a new field that contains PII or credentials, flag it in your PR for security review. Last modified on June 10, 2026
