Security

• Organization isolation

  Every Store surface is scoped by organization membership, and row-level security policies enforce that isolation in the database.

• Registered devices only

  A Store iPad opens the Store Hub only when the signed-in Store account and an active device registration agree on the exact organization, business, and location. Mismatched, revoked, or unregistered devices fail closed.

• Server-resolved context

  Organization, business, and location context is resolved on the server from the registered device. The browser cannot supply or change the scope used for Store data.

• No credentials in launch targets

  Store App launch targets are limited to credential-free HTTPS links or approved Apple Shortcut run links. Passwords, tokens, and secret parameters are never stored in a Store App link.

• Honest availability

  When an upstream system such as the Daily Brief, Store Apps, or the Store Network is unavailable, OpsOSHQ says so instead of showing placeholder or estimated data.