Security That's Engineered In, Not Bolted On
Tenant isolation at the database layer. MFA at the authentication layer. Audit logging at every layer. Certificate pinning on every mobile device. This is how a platform earns enterprise trust.
Row-Level Security (RLS)
1,265 RLS policies across every tenant-scoped table enforce tenant isolation at the database query level. Every request is filtered by tenant context via security-definer functions. No RLS exceptions exist anywhere in the system. Cross-tenant data access is prevented by architecture.
Not application-level filtering. Database-level enforcement. No bypass path exists.
Dual-Layer Role-Based Access Control
Application roles determine which dashboard a user sees. Staff role codes determine which modules are accessible within that dashboard. Priority hierarchy ensures admin-tier roles override staff-level restrictions. Promotion to management auto-grants admin access; demotion auto-revokes it.
19 role definitions across 5 portals, from Platform Owner and Admin through Director, Manager, Ops Manager, Supervisor, HR, Training Admin, Employee, Client, and Applicant.
Multi-Factor Authentication
Mandatory TOTP MFA for platform owners and admin roles. Configurable tenant-level enforcement for employees. Admin login is restricted to company domain emails; no OAuth bypass is allowed. Separate auth endpoints for clients (/login), employees (/auth), and admins (/admin-login).
Auth segmentation ensures no credential confusion between user tiers.
7-Year Audit Trail
Platform audit logs capture all cross-tenant actions via centralized RPC. Required fields: event_type, actor_id (auto email resolution), target_type, target_id, tenant_id, details (JSONB), and severity classification (info/warning/error/critical).
Audit logs: 7 years. API usage logs: 2 years. Auth logs: 90 days.
PII Isolation & Data Protection
Compensation data excluded from all non-admin views via column-level grants. Disciplinary records restricted to platform owners, admins, and the affected employee. Safe database views with security-invoker that exclude sensitive fields from general queries.
Table-level SELECT revoked and re-granted only on non-sensitive columns.
Tenant-Scoped Identity Validation
Canonical resolvers verify both user identity AND tenant membership on every request. Employee identity validation checks auth.uid() match AND tenant_id match. Platform owner authority recognized through unified RPC with complete audit trail.
Scoped RPCs ensure sensitive data is only accessible through security-definer functions.
Session & Device Control
Every session is monitored. Every device is validated. Every context switch is audited.
- Active session monitoring with IP tracking, user agent logging, and session expiration
- Login lockout tracking for failed admin login attempts with configurable thresholds
- Device trust management with forced logout capabilities across all active sessions
- Context-switch audit: every platform owner tenant entry recorded with deep-clean cache purge on exit
- Separate auth endpoints for clients, employees, and admins prevent credential confusion
Mobile Security Hardening
Most operations happen on phones, not desktops. Field devices are secured with the same rigor as the platform itself.
Jailbreak / Root Detection
Device compromise checks verify secure lock screen and detect jailbroken/rooted devices before granting platform access. Compromised devices are blocked.
Secure Token Storage
Authentication tokens stored in Keychain (iOS) and Keystore (Android) via dedicated Capacitor plugin. Tokens never stored in plaintext or accessible to other apps.
Certificate Pinning
Configured pinned domains with version tracking prevent man-in-the-middle attacks on all mobile API communications. Pinned certificates rotate with app updates.
Geofence Enforcement
GPS verification on every clock-in/out, DAR entry, and patrol checkpoint scan. Guards operating outside site geofence boundaries trigger real-time supervisor alerts.
Security Governance
Documented policies and procedures that demonstrate enterprise-grade security posture to your clients and their auditors.
Vendor Risk Assessments
Documented risk assessments for all sub-processors, including Supabase (database), Stripe (payments), Resend (email), Mapbox (geolocation), hCaptcha (bot protection).
Incident Response Runbook
Severity levels (SEV0–SEV3) with defined triage steps, containment protocols, communication procedures, and post-incident review requirements.
Log Retention Policy
Formal retention schedules enforced at the infrastructure level: 7 years for audit logs, 2 years for API usage, 90 days for authentication events.