Security & data isolation
The one-pager enterprise buyers ask for. How tenant data is isolated, how identity is checked, and where the bright lines are. If something here is unclear, email us.
Team-scoped row-level security
Every user-data table runs Postgres row-level security keyed on team_id. The check function is_team_member(team_id, auth.uid()) is the single source of truth — every policy on every table delegates to it. A signed-in user from team A literally cannot select, insert, update, or delete a row that belongs to team B; the database refuses before the server fn returns.
Bearer-validated server functions
Every protected server function declares the requireSupabaseAuth middleware. The bearer token is re-validated against the auth server on every call — sessions can't be forged client-side, expired tokens are rejected, and the resulting Supabase client acts as the user (RLS still applies). Service-role writes are reserved for trusted webhook handlers behind a signature check.
Scoped public SDK keys
Programmatic access uses per-team API keys minted from the workspace settings UI. Keys are stored hashed (SHA-256, server-only verification via verify_api_key()), can be revoked instantly, and carry a last_used_at timestamp for audit. Public SDK routes live under /api/public/sdk/v1/* and are locked by a 15-test drift-guard suite.
Data residency
Application traffic is served from Cloudflare's global edge (Workers runtime). Tenant data lives in a single managed Postgres region — see request data-residency details for the current region and replication posture. Dedicated single-region deployments are available for enterprise plans.
No PII in logs
Server functions never log raw input payloads. The AI Engineer copilot redacts secrets and caps context at 8 KB before any LLM call. Workspace activity logs capture event kinds + subjects (e.g. ai.engineer / simulation name), not free-form fields. External error logs (Cloudflare, Supabase) carry only opaque IDs.
SAML 2.0 single sign-on
Enterprise plans support SAML SSO with Okta, Azure AD / Entra ID, Google Workspace, OneLogin, JumpCloud, and any compliant IdP. We configure the connection from your IdP metadata URL — give us the URL and the email domains to claim. SCIM 2.0 user provisioning is on the roadmap. Email us to start the SSO setup.
Compliance & questionnaires
SOC 2 Type II is in progress. For active questionnaires (CAIQ, SIG Lite, vendor risk forms), security architecture reviews, or a signed DPA / BAA, email security@wellboregenius.com with your timeline and we'll route to the right person within 1 business day.