Security as a feature, not an afterthought.
Every tenant table runs Postgres row-level security with FORCE and WITH CHECK. Webhooks are signed and replay-resistant. The runtime database role cannot bypass RLS. We document everything at /trust.
Multi-tenant RLS. Stripe-grade webhook verification. Two-role Postgres separation.
3 modules. One security surface.
Each card jumps to the detailed section below. Every module ships today unless flagged otherwise in copy.
Cross-tenant data leak isn't a bug we patch. The database refuses to allow it.
Every tenant-scoped table has a Postgres row-level security policy keyed to the current organization. The runtime role is NOSUPERUSER NOBYPASSRLS, so even if a query is malformed, no row from another tenant is returned. We test cross-tenant isolation in CI with Testcontainers.
Jump to sectionNo one can fake a webhook or replay an old one.
Every webhook from Stripe and Clerk is verified by HMAC-SHA256 signature with a 300-second replay tolerance. We track every processed event ID per organization in billing_events with a UNIQUE index, so replays are no-ops. Failed signature checks return 401 silently and never reveal why.
Jump to sectionEvery state change logged. Forever.
Audit log entries are written for every campaign create, affiliate invite, payout dispatch, billing event, AI co-pilot action, and admin override. The log is append-only, scoped to the organization, captures actor and action and target and timestamp and the request origin as seen at our edge, and is searchable from the admin app.
Jump to sectionWhat this surface delivers.
Security at a glance
Multi-tenant RLS. Stripe-grade webhook verification. Two-role Postgres separation.
Built into Security
Every mutation, every actor
HMAC-SHA256 verified
Enforced at the database
Cross-tenant data leak isn't a bug we patch. The database refuses to allow it.
Every tenant-scoped table has a Postgres row-level security policy keyed to the current organization. The runtime role is NOSUPERUSER NOBYPASSRLS, so even if a query is malformed, no row from another tenant is returned. We test cross-tenant isolation in CI with Testcontainers.
- FORCE ROW LEVEL SECURITY on every tenant table (15+ today)
- WITH CHECK clause prevents cross-tenant inserts
- Two-role Postgres: rekomi (superuser, migrations) and rekomi_app (runtime, NOSUPERUSER NOBYPASSRLS)
- Cross-tenant isolation enforced by Testcontainers integration tests in CI
No one can fake a webhook or replay an old one.
Every webhook from Stripe and Clerk is verified by HMAC-SHA256 signature with a 300-second replay tolerance. We track every processed event ID per organization in billing_events with a UNIQUE index, so replays are no-ops. Failed signature checks return 401 silently and never reveal why.
- Stripe webhooks: HMAC-SHA256 signature with 300s replay window
- Clerk webhooks: Svix signature verification
- Every event recorded to billing_events for idempotency and audit
- Failed signature returns 401, never reveals which check failed
Every state change logged. Forever.
Audit log entries are written for every campaign create, affiliate invite, payout dispatch, billing event, AI co-pilot action, and admin override. The log is append-only, scoped to the organization, captures actor and action and target and timestamp and the request origin as seen at our edge, and is searchable from the admin app.
- Append-only audit_log table per organization
- Captures actor, action, target, timestamp, and the request origin as seen at our edge
- Searchable from the admin app
- Kept indefinitely for compliance review
Common questions.
Where is data stored?
Postgres on a managed provider (production); the app and click-tracking API run on managed regional infrastructure. US region only today. EU hosting is on the roadmap.
Is data encrypted at rest?
Yes. AES-256 at rest, TLS 1.3 in transit. API key signing secrets are encrypted at rest via ASP.NET Core Data Protection. Field-level encryption of tax form identifying fields is a planned hardening step.
Do you have a SOC 2 report I can read?
Not yet. We do not claim a certification we do not yet hold. Our security model is documented in detail at /security and /trust. When an independent third-party audit completes, we will send the report under NDA on request.
What happens to my data if I cancel?
You can export your data at any time, before or after cancelling. On cancellation your data is retained so you can reactivate, and it is deleted on request or when you delete the account. Audit log entries about your organization are kept indefinitely for legal compliance.
Can I bring my own AWS / GCP / Azure?
Not currently. BYO-cloud is on the enterprise roadmap. We use a managed Postgres provider and Cloudflare for the edge. Both meet enterprise security baselines.
Is there a public bug bounty?
Not yet. A formal program is on the roadmap. Until then, please report security issues to support@rekomi.com and we will acknowledge within one business day.
Do you support SAML SSO?
Not yet. SAML SSO is on the enterprise roadmap. Today, Clerk handles authentication with email + password, magic link, and OAuth providers.
Other parts of Rekomi.
Security is one of eight surfaces. Each is built on the same primitives - Stripe, Postgres with RLS, Clerk, Anthropic - and ships with the same audit and security bar.
Ten minutes to first click.
14-day free trial. Native Stripe, Paddle, Braintree, and more. No card. Live this afternoon.
- 14-day free trial
- Cancel anytime, $0 charged