Security evidence

WorkOS AuthKit provides sign-in and session identity. Sensitive Convex functions independently require authenticated accounts and resource authorization.

Sensitive actions require authentication and resource authorization.

Protected organization, order, contract, payment, calendar, brand, and communication operations implement membership, ownership, or participant checks in Convex.

Authorization tests exercise critical boundaries. Their coverage is not a guarantee that every possible authorization defect has been excluded or that a deployment is certified.

Razorpay checkout confirmation verifies provider signatures and reconciles captured payments. Contract OTP signatures are bound to a contract version and evidence record.

Payment collection and creator payouts are tracked separately. Review the relevant payment and settlement records.