Row-Level Security
Tenant and client access rules are enforced in PostgreSQL, not inferred only from routes or hidden controls.
Security overview
Access control designed around the data boundary.
ClientFlow OS is designed so a modified URL, record ID, request body, or browser state does not grant access to another organization or client.
Role-based permissions
Owners, administrators, managers, workers, vendors, client admins, and viewers receive deliberately different capabilities.
Private file storage
Files live in a private Supabase bucket and are served only through policies tied to organization membership.
Immutable audit trail
Important creates, changes, approvals, AI actions, archives, exports, and access events are recorded for review.
Secrets stay server-side
Database secret keys, Gemini credentials, cron secrets, and email provider keys are never bundled into browser code.
Infrastructure controls
Transport encryption, at-rest encryption, and backups depend on the configured Supabase and Vercel plans.
User responsibility: workspace owners must configure appropriate roles, use strong authentication, review invitations, and select provider plans that meet their backup, retention, and compliance requirements. ClientFlow OS does not claim certifications that have not been independently obtained.