Home / Product / Security
Compliance is architecture.
Isolation, encryption, and access control live in the database and key-management layers, where a bug or a compromised service can't route around them.
Tenant & barrier isolation
The wall is below the app.
Row-level security restricts every query to the requesting namespace.
RESTRICTIVE policies deny cross-barrier reads even for the table owner, verified in CI against a non-superuser role.
The app runs as a non-superuser, non-BYPASSRLS Postgres role, documented and tested.
A compromised service with valid DB credentials still cannot read across a wall.
Encryption & key management
Per-subject keys, your KMS.
| Data | Protection |
|---|---|
| Memory content (PII/PHI/MNPI) | AES-256-GCM at rest under a per-subject DEK; TLS in transit. |
| Embeddings | Stored in pgvector; a local embedding provider keeps text in-perimeter. |
| Audit events | SHA-256 hash chain; append-only; optional Merkle anchoring. |
| API keys | Stored only as SHA-256 hashes; individually revocable. |
| Subject keys (DEKs) | Wrapped by a master key from your KMS (env / AWS / Azure / Vault); destroyed on erasure. |
Access control & operations
Scoped, audited, observable.
Namespace-scoped with read / write / admin scopes, checked on every request.
Owner / analyst / compliance / readonly roles expand to scope sets at auth time.
OIDC / SAML via gateway forward-auth.
Stream audit events to Splunk, Datadog, or Elastic.
Idempotent writes, liveness/readiness probes, and per-key rate limiting.
Hard-fails any config that would send data to an external service.