Security

Separation between organisations

Every organisation’s records are separated inside the database with PostgreSQL row-level security, so a mistake in application code cannot show one organisation another’s data. We run an automated test that signs in as a member of one organisation and tries to read, change and delete another organisation’s rows on every table that holds organisation data. It must find nothing, and it passes.

Access control

• Roles and permissions are enforced on the server for every page, action and API call. Hiding a button is never the control.
• Managers see their own team’s records. Deleting or changing deal values can require an administrator’s approval.
• Organisation owners and administrators can require two-step sign-in with an authenticator app. Our own platform staff must use one.
• Sessions expire after 7 days without activity and after 30 days at most. Disabled users lose access immediately.
• Refused actions are recorded in the audit log.

Data protection

• All traffic uses HTTPS (TLS 1.2 or newer). Older protocol versions are refused.
• Passwords are stored as one-way hashes. Connected-account credentials (mailboxes, WhatsApp, Meta) are encrypted before they are stored.
• The audit log is append-only: changes and deletions are blocked in the database itself.
• Database backups are taken every night and a restore is tested.
• Uploaded files are served with downloads forced and scripts blocked.

How we check

• The public site is graded A+ by the Mozilla Observatory.
• We scan our source code with Semgrep (OWASP Top 10, TypeScript and Next.js rule sets) and our dependencies with npm audit before releases.
• Inbound webhooks from WhatsApp and Meta must carry a valid provider signature. Outbound webhook addresses to private or internal networks are refused.

Where data is stored

Production data is hosted by Hostinger in India (Mumbai). See the subprocessor list for every provider that handles data on our behalf.

Report a vulnerability

If you believe you have found a security problem, email admin@rahwe.tech with the details and steps to reproduce. Please do not access other people’s data, disrupt the service, or publish the issue before we have had a reasonable chance to fix it. We will acknowledge your report and keep you updated. Our security.txt has the same contact.