Security built into the data boundary

Every application table is protected by Postgres Row Level Security (RLS). The tenant boundary is attached to the data model itself, so it applies consistently across browser requests, background work and administrative queries.

Application authorization still checks the signed-in person’s organization and role. RLS provides the independent data-layer boundary if an application query is incomplete or incorrect.

What “forced” means

Standard RLS protects ordinary roles. Forced RLS also applies those policies to the table owner, closing an exemption that could otherwise affect migrations, support queries or background work.

All 79 application tables use forced RLS. A schema trigger applies the same setting to new tables as they are added.

A cross-tenant reference is a constraint violation, not a bug

Tenant isolation covers references as well as reads. Relationships such as requirement-to-project include both the organization and the record identifier, preventing a row in one organization from pointing to a record in another.

So 111 of the 275 references in the schema are declared on the pair (organization, id). A cross-organization reference does not satisfy the constraint and cannot be written.

380 further constraints hold the rules that are not about tenancy: that an acceptance names a real person, that the person who publishes a revision is not the person who submitted it, that a monitoring check can never be recorded as if it had blocked something.

Two ways a boundary like this is bypassed

Views and privileged functions receive explicit treatment because both can change which role evaluates a policy.

• Views. This schema has 3; all 3 run with the caller’s security context so the caller’s tenant policies remain in force.
• Privileged functions. There are 147 functions that run as their owner, and all 147 pin the namespace used to resolve referenced objects.

Measured on 16 August 2026, 0 days ago, by reading the production database’s own catalogue. This page is built from that measurement rather than from a live query. The operator credential required to read the policy catalogue is kept off the public request path.

Each release uses a signed-in identity from one organization to attempt reads and writes against other organizations across every tenant-scoped table. The proof uses the same interface as the browser, and every cross-tenant attempt must be refused.

The run enumerates the tables from the catalogue rather than from a list, so a table added tomorrow is covered tomorrow. A table added with no organization id on it is reported by name instead of being skipped quietly.

Last run on 16 August 2026, 0 days ago. Outcome: no foreign row was readable and no foreign write was accepted. This is the record of a run at a moment, not a live check, and an administrator of a tenancy can see the same record inside their own workspace.

Core application data is stored by Supabase and the application is delivered by Netlify. Encryption at rest and in transit is provided by those managed platforms. When the optional voice assistant is enabled, a tenant-scoped workspace brief and the live conversation are sent to Google Gemini as listed under Subprocessors.

• At rest. The database and its backups are stored encrypted with AES-256 by the managed Postgres platform (Supabase).
• In transit. Every connection — browser to application, application to database — is TLS 1.2 or above, terminated by the application host (Netlify) and by the database platform. There is no unencrypted listener to reach.

Current scope: customer-managed encryption keys, field-level or column-level encryption, and a contractual data residency commitment are not currently offered.

Every act that changes the register’s claims is written to an append-only trail. Deletion is blocked for workspace users, owners and privileged platform roles, and the release proof verifies that boundary by attempting the deletion. Each actor is taken from the authenticated session rather than supplied by the client.

The trail is retained for the life of the tenancy and does not roll off on a fixed short-term schedule.

Procurement scope: read-access logging, scheduled machine-readable exports, certified deletion and litigation hold are not active controls. They can be scoped as enterprise requirements; the page does not represent them as implemented. Proposed

Portfolio governance does not require protected health information (PHI) or payment-card data. Product fields and import formats are designed for portfolio records, requirements, citations, test outcomes, findings and dispositions.

That scope is a design and contractual boundary, not a technical prevention control. Onboarding acknowledgement, a maintained ingestion boundary and pattern screening for bulk imports are planned, not active.

Enterprise review: confirm data classification, ingestion controls and any required business associate agreement before a regulated-data use case is activated.

Notification timing, escalation contacts and response obligations are defined in the applicable enterprise agreement. Until those operating commitments are executed for a tenancy, this page makes no fixed response-time promise.

Security contact: security@portfolioplane.com — also published machine-readably in security.txt (RFC 9116). Incident-response commitments are finalized in the applicable commercial agreement.

• Backups. Daily encrypted backups with point-in-time recovery, managed at the database platform layer. Recovery objectives are established in commercial terms for the estate in question.
• Dependency posture. Dependency advisories are triaged for reachability. Tests preserve any boundary used to classify an advisory as unreachable, and current dispositions are available during a security review.

Current subprocessors and the data each receives are listed below. Notice and objection rights are established in commercial terms.

Existing workspace administrators can review their tenancy’s isolation facts and the dated refusal receipt under Settings. For a questionnaire, control clarification or disclosure, contact the security team.

Contact securityHow the controls work