Trust, with receipts.

What we claim

The claim that matters most: every client on iziwerk is walled off from every other, and the wall is enforced at the data layer — the database itself — not just hidden in the interface. If that holds, your contracts, invoices and files are seen only by the people who should see them. Everything else on the security page builds on it.

The suite that tries to break in

We don't take that claim on faith. iziwerk carries a suite of adversarial isolation tests — checks that sign in as the wrong person on purpose and try to break in. Read another client's files. Rewrite someone else's invoice. Escalate a client account into an owner. Reach data through side doors instead of the front one. Every trick we can think of, written down as a test that genuinely attempts it.

A check passes only when the database refuses. Not the interface, not a polite error page — the data layer itself says no. Right now the suite is 556 assertions, and all 556 are green against the live database.

How it runs

The suite runs whenever anything touching the data layer changes. It only ever grows — every new feature that stores something ships with new break-in attempts alongside it, and old tests never retire. One red assertion blocks the change. No exceptions, because the whole point is that there are no exceptions.

The layers behind it

Isolation is one layer of several:

• Access rules live inside the database — checked on every single query, so there is no code path around them.
• Secrets exist only on the server. Your browser never holds a key worth stealing.
• Payment events are cryptographically verified. A "subscription paid" message is accepted only with a valid signature — nobody can fake one.

What this doesn't prove

Honesty matters more than a clean scorecard, so, plainly: this suite is written and run by us, not by an outside auditor. It proves the walls hold against every attack we thought of — an independent penetration test, which pays professionals to think of what we didn't, is on the roadmap for when the business justifies it. Until then, we'd rather show you our method than borrow a badge.

Questions

Ask. If something here is unclear — or you can think of a break-in we should be attempting — write to hello@iziwerk.com. Finding a hole means finding it before someone else does.