Cloudflare Access
The `/admin` workspace requires Access identity, and the Worker independently validates issuer, audience, expiry, and the configured owner identity before operational data loads.
CLOUDFLARE FOUNDATION
Private owner data stays behind an explicit boundary.
HVAC Core separates public product or contractor pages from the protected owner workspace and keeps each external entry point behind the verification appropriate to it.
D1 operational records
Leads, customers, estimates, invoices, payments, appointments, and activity remain in the bound D1 database behind server-side operations routes.
Public request protection
Contractor lead capture uses bounded JSON input, server validation, a honeypot, and server-side Turnstile verification before D1 persistence.
Mutation controls
Owner mutations enforce same-origin rules, bounded bodies, validation, private/no-store response behavior, and explicit revision/state checks.
Optional Stripe boundary
Stripe webhook processing requires a signature, validates supported event data, and uses an idempotency ledger before recording payment.