Security as a feature, not an afterthought.
Every tenant table runs Postgres row-level security with FORCE and WITH CHECK. Webhooks are signed and replay-resistant. The runtime database role cannot bypass RLS. We document everything at /trust.
Multi-tenant RLS. Stripe-grade webhook verification. Two-role Postgres separation.
3 modules. One security surface.
Each card jumps to the detailed section below. Every module ships today unless flagged otherwise in copy.
Cross-tenant data leak isn't a bug we patch. The database refuses to allow it.
Every tenant-scoped table has a Postgres row-level security policy keyed to the current organization. The runtime role is NOSUPERUSER NOBYPASSRLS, so even if a query is malformed, no row from another tenant is returned. We test cross-tenant isolation in CI with Testcontainers.
Jump to sectionStripe and Clerk verified by HMAC. 300-second replay window.
Every webhook is verified by HMAC-SHA256 signature with a 300-second replay tolerance. We track every processed event ID per organization in billing_events with a UNIQUE index, so replays are no-ops. Failed signature checks return 401 silently and never reveal why.
Jump to sectionEvery state change logged. Forever.
Audit log entries are written for every campaign create, affiliate invite, payout dispatch, billing event, AI co-pilot action, and admin override. The log is append-only, scoped to the organization, captures actor and action and target and timestamp and IP, and is searchable from the admin app.
Jump to sectionWhat this surface delivers.
Security at a glance
Multi-tenant RLS. Stripe-grade webhook verification. Two-role Postgres separation.
Built into Security
Every mutation, every actor
HMAC-SHA256 verified
Enforced at the database
Cross-tenant data leak isn't a bug we patch. The database refuses to allow it.
Every tenant-scoped table has a Postgres row-level security policy keyed to the current organization. The runtime role is NOSUPERUSER NOBYPASSRLS, so even if a query is malformed, no row from another tenant is returned. We test cross-tenant isolation in CI with Testcontainers.
- FORCE ROW LEVEL SECURITY on every tenant table (15+ today)
- WITH CHECK clause prevents cross-tenant inserts
- Two-role Postgres: rekomi (superuser, migrations) and rekomi_app (runtime, NOSUPERUSER NOBYPASSRLS)
- Cross-tenant isolation enforced by Testcontainers integration tests in CI
Stripe and Clerk verified by HMAC. 300-second replay window.
Every webhook is verified by HMAC-SHA256 signature with a 300-second replay tolerance. We track every processed event ID per organization in billing_events with a UNIQUE index, so replays are no-ops. Failed signature checks return 401 silently and never reveal why.
- Stripe webhooks: HMAC-SHA256 signature with 300s replay window
- Clerk webhooks: Svix signature verification
- Every event recorded to billing_events for idempotency and audit
- Failed signature returns 401, never reveals which check failed
Every state change logged. Forever.
Audit log entries are written for every campaign create, affiliate invite, payout dispatch, billing event, AI co-pilot action, and admin override. The log is append-only, scoped to the organization, captures actor and action and target and timestamp and IP, and is searchable from the admin app.
- Append-only audit_log table per organization
- Captures actor, action, target, timestamp, IP
- Searchable from the admin app
- Retained for the lifetime of the account for compliance review
Common questions.
Where is data stored?
Postgres on a managed provider (production); the app and click-tracking API run on managed regional infrastructure. Both US-region by default. EU region available on Pro+ plans.
Is data encrypted at rest?
Yes. AES-256 at rest, TLS 1.3 in transit. API key signing secrets are encrypted at rest via ASP.NET Core Data Protection. Field-level encryption of tax form identifying fields is a planned hardening step.
Do you have a SOC 2 report I can read?
Not yet. We do not claim a certification we do not yet hold. Our security model is documented in detail at /security and /trust. When an independent third-party audit completes, we will send the report under NDA on request.
What happens to my data if I cancel?
30-day grace period during which you can export. After that, data is purged. Audit log entries about your organization are retained for legal compliance per the standard SaaS schedule.
Can I bring my own AWS / GCP / Azure?
Not currently. BYO-cloud is on the enterprise roadmap. We use a managed Postgres provider and Cloudflare for the edge. Both meet enterprise security baselines.
Is there a public bug bounty?
Not yet. A formal program is on the roadmap. Until then, please report security issues to security@rekomi.com and we will respond within one business day.
Do you support SAML SSO?
Not yet. SAML SSO is on the enterprise roadmap. Today, Clerk handles authentication with email + password, magic link, and OAuth providers.
Other parts of Rekomi.
Security is one of eight surfaces. Each is built on the same primitives - Stripe, Postgres with RLS, Clerk, Anthropic - and ships with the same audit and security bar.
Ten minutes to first click.
14-day free trial. Native Stripe, Paddle, Braintree, and Shopify. No card. Live this afternoon.
- 14-day free trial
- Cancel anytime, $0 charged