Security & architecture
Written for the person who has to sign off on us. Every claim below names the mechanism behind it, and the last section lists what Cevoriq does not claim — because the fastest way to lose a security review is to be caught overstating one thing while everything else was true.
| Tenant isolation | PostgreSQL row-level security | Isolation is enforced by the database, not by application code remembering to add a WHERE clause. Policies are attached to the tables themselves and forced on, so a query that forgets its tenant returns nothing rather than everything. |
|---|---|---|
| Authentication | Clerk | Credentials, MFA and sessions live with the identity provider. Cevoriq stores no passwords. A sign-in never passes a password through Cevoriq's servers. |
| Authorisation | Roles held in Cevoriq | Who may sign in is the identity provider's decision; what they may do is Cevoriq's. Membership and role are recorded per tenant, and module access is granted per member. |
| Hosting | Vercel, US East (Virginia) | Application and API run in a single region today. See the region table below. |
| Database | Supabase PostgreSQL 17 | Managed Postgres with pgvector for the embedding-backed features. |
| Object storage | Cloudflare R2 | Contract documents and uploads. Objects are written and read server-side through signed URLs; the browser never holds a storage credential. |
| Stored secrets | AES-256-GCM | Where you supply your own AI provider key, it is encrypted at rest with an authenticated cipher and decrypted only to make the call you asked for. |
| Audit trail | Who, what, when, and the values | Create, update and delete are recorded with the actor, the entity, and the old and new value of each changed field — not merely that something changed. |
The isolation is tested adversarially, on every change
Cevoriq has a reporting feature that lets a language model query your data directly. That is a real risk, so it is defended by the database rather than by trusting the model: the reader connects as a restricted role, the tenant context is sealed so it cannot be forged, and row-level security decides what is visible.
A suite of 28 adversarial queries — attempts to read across tenants, to escalate, to forge the tenant context — runs in continuous integration and fails the build if any one of them returns data it should not. It is deliberately separate from the reporting scans, which collect findings without blocking, because a security boundary that reports green while broken is worse than no check at all: the green tick is what stops anyone looking.
Backups that have to prove themselves
A nightly job dumps the production database, restores that dump into a throwaway PostgreSQL, and compares a row-count digest against the source. If the restore fails or the digest differs, the job fails and nothing is published — because an untested backup is a belief, not a capability.
The dump is encrypted before it is stored, and the identity directory is exported and encrypted alongside it, so a recovery can re-link people to their restored records rather than restoring rows that point at identifiers no longer in existence. A failed run raises an alert to a human; it does not simply go red in a log.
Where your data lives
0 regions are live today. The rest are on the roadmap and are refused if selected — a region becomes available only when a real stack exists behind it, and an automated check fails the build if one is marked available without one.
AI recommends. Your team decides.
Cevoriq's decisions are proposals. Each one records the inputs it used and the reasoning it gave, and a person approves or rejects it — the platform does not act on your fleet on its own. You may also supply your own AI provider key, in which case your data goes to your account with your provider, under your agreement with them, rather than through ours.
What Cevoriq does not claim
- No point-in-time recovery. Recovery is from the most recent nightly backup, so the worst case is a day of data. Say so in your risk assessment rather than assuming continuous recovery.
- 0 regions today. Data residency outside is roadmap, and selecting another region is refused rather than silently accepted.
- Retention periods are recorded, not yet automatically enforced. The setting is shown read-only for that reason. An audited instruction to delete that the platform did not carry out is evidence against the platform, so it is not presented as something it is not.
- No third-party certification yet. There is no SOC 2 report or ISO 27001 certificate to hand you. What is above is what exists, described precisely enough to verify in a technical review.