Support · Security & data
Database isolation
Every table enforces row-level security scoped to your organisation — members of one tenant cannot read another’s rows even with authenticated database access. Key-material columns add a second layer: column-level revocations.
Row-level security everywhere
Policies scope every table by organisation membership. The dashboard’s authenticated client inherits this automatically; there is no code path that reads cross-tenant rows through normal operation.
Why column revocations too
RLS would still let your own members select your own tenant’s encrypted key columns. Column-level REVOKEs close that residual path: even authenticated queries cannot touch key material. Defence in depth, not redundancy.
The service-role exception, bounded
A service-role client bypasses RLS by nature, so it is confined to workers and the few server actions that must write rows no user policy allows (audit entries, organisation creation). Its usage surface is deliberately tiny.