RLS, every table, every query.
Postgres Row-Level Security. Every table has tenant_id NOT NULL. JWT-injected
tenant context. SECURITY DEFINER functions. Defense-in-depth .eq('tenant_id', X)
on every admin-client query.
Row-level security in Postgres. Defense-in-depth on every admin query. Per-tenant secret encryption for API keys and webhook secrets. Real backups. SOC 2 Type II audit in 2026.
Postgres Row-Level Security. Every table has tenant_id NOT NULL. JWT-injected
tenant context. SECURITY DEFINER functions. Defense-in-depth .eq('tenant_id', X)
on every admin-client query.
Per-tenant secret encryption for API keys, webhook secrets, OAuth tokens. Keys rotated on schedule. No tenant data in shared encryption envelopes.
Supabase Auth. Short-TTL JWTs with refresh tokens. 2FA available. SAML / OIDC SSO for Scale customers, alongside audit log, approvals, and an SLA.
PITR with 30-day retention. Verified-restore tested monthly. Disaster recovery procedure documented and rehearsed.
SOC 2 Type II in 2026 — audit in flight. GDPR-aware (DPA available, EU subprocessors listed). India DPDP-compliant. Data-export endpoint live. We don't fake-claim certifications we don't hold.
Listed at /trust/subprocessors. Updated when changed.
Postgres + Auth + Storage
Subscription + invoice payments
Transactional + marketing
Durable background jobs
App + edge cache
Application error tracking
BYOK — your bill, our routing
100+ language transcription
PGP key on /trust/security-pgp. We respond within 24 hours.