Numbers are allocated once
A document number comes from the database under a row lock, never from
application code. Two deals cannot share a number — which is not recoverable
once both PDFs have been sent.
A document locks when it renders
Once an order form has been rendered, sent or invoiced it stops being
editable. The thing you sent is the thing on file, and a correction is a new document
rather than a quiet overwrite.
The audit trail is append-only
Not by convention — by rule, inside the database. Updates and
deletes on the trail do nothing at all. A record an administrator can tidy up is not
evidence.
Signing links are never stored
A signing link is a bearer credential, so only its hash is kept. It
exists exactly once, in the link that was sent. It can be reissued, never recovered
— which is the honest answer.
Companies are separated by the database
Row-level security in Postgres, on every table, checked against a real
second tenant rather than asserted. Application code never filters by company, because
a second answer to that question is how the two come to disagree.
Your paper stays yours
Documents export as the same JSON and PDF they were built from. An
archive of executed agreements should not need a running web service to be read
— including ours.