Core protections
- Internal staff operations are separated from public and customer navigation
- Customers can load only their own account, requests, quotes and bookings
- Profile and identity images are required for new public accounts
- Password validation, CSRF protection and authenticated updates
- No full card number, CVV or mobile-money PIN storage in portal forms
- File type, quantity and size validation for uploads
- References and records support reconciliation and complaints
