#101 — Security baseline — launch-gating security controls (P0)

The concrete security controls that must be in place before real client/taxpayer data lands — the P0 gate on going live with a real firm. Six control groups:

1. Tenant isolation & authorization — server-side org scoping so Firm A can never reach Firm B data, object-level authorization on every endpoint, firm/user RBAC (admin/staff/client/owner/support/billing), least privilege, cross-tenant access tests.
2. Secure auth & sessions — password rules, brute-force protection, account recovery, MFA (internal admins first, then customer admins), secure cookies, idle timeout, refresh-token rotation, logout + session invalidation.
3. Secure document handling — upload validation (MIME / size / extension allowlist), malware scanning, storage isolation, expiring permission-checked upload/download links, download logging.
4. Encryption & secrets — TLS in transit, encryption at rest, encrypted backups, key management, managed secrets vault + rotation (no secrets in code).
5. Audit-logging foundation — user activity (view/upload/download/change/delete), admin + impersonation activity, authorized-user and data-access logs.
6. Secure-configuration baseline — hardened cloud / storage / database settings, no public buckets, least-privilege network rules.

Builds on Firmary's existing platform strengths — multi-tenant + OpenFGA object-level authz, Logto auth/session, TLS, S3 storage isolation, AES-encrypted vendor creds — so this epic closes remaining gaps, verifies end-to-end, and produces evidence, rather than building greenfield. launch-truth-table.md is authoritative for what is actually proven.

Frameworks satisfied: OWASP ASVS · SOC 2 Security+Confidentiality · FTC Safeguards / IRS Pub 4557 / GLBA · GDPR/CCPA · CIS/ISO 27001/CSA. Size: L. Source: product-roadmap.md §3 (Phase 0 epic) + §15. Full control-by-control matrix + built-vs-gap posture lives on the team needs-daniel board.