# Mapping to the uploaded source

The uploaded document describes a 12-part security/payment architecture.

1. Protect the entire `.com`
   → Cloudflare Access configuration.

2. Approve clients by exact email
   → `clients` table + Access policy instructions.

3. Do not use one shared password
   → Individual email approval + OTP architecture.

4. Build services behind login
   → Dashboard + `services`, `orders`, `appointments`, `documents`, `messages`.

5. Use Paystack securely
   → `Paystack.php` + `create-payment.php`.

6. Verify payment
   → callback verification + webhook verification.

7. Approval database
   → `clients`, statuses and audit logs.

8. Expiring invitations
   → `invitations` schema + token algorithm.

9. Keep out of search
   → meta robots + `X-Robots-Tag`.

10. Protect origin
   → Cloudflare Tunnel/firewall guidance.

11. Do not protect webhook with client login
   → webhook route intentionally public to Paystack but signature-protected.

12. Final structure
   → public client routes, admin area and webhook route.

The source document itself is preserved as the authority for the requested structure; this package adds implementation detail where the source calls for it.