Security
Security architecture, compliance certifications, and data protection measures.
Overview
Security is foundational. Multi-tenant data isolation is enforced at the database level via Row-Level Security (RLS). All data is encrypted at rest and in transit.
Multi-Tenant Isolation
Every database query is automatically filtered by company_id. This is enforced at the PostgreSQL level using Row-Level Security policies, not application code.
Company A cannot access Company B's data under any circumstances. Even raw SQL queries execute within the tenant context set by RLS policies.
Implementation
- All 429 tables include
company_idcolumn - RLS policies enforce filtering at database level
- JWT tokens contain company context
- All API endpoints inherit tenant filtering
- Audit logs track cross-tenant access attempts
Compliance
Annual audits for security, availability, and confidentiality controls.
BAA available. PHI protection for healthcare customers.
Card tokenization. No card data stored on our servers.
Data portability, right to deletion, consent management.
Security Features
Data Protection
Every query filters by company_id. Row-level security (RLS) on all 429 tables.
AES-256 encryption at rest, TLS 1.3 in transit, encrypted backups.
Compliance
Full HIPAA compliance for healthcare data with BAA support.
GDPR-compliant data handling with right to deletion.
PCI DSS Level 1 compliant payment processing.
SOC 2 Type II certified for enterprise security requirements.
Access Control
JWT tokens, MFA, SSO, and role-based access control.
Rate limiting, API key management, and request signing.
AI Security
AI prompt injection prevention and content filtering.
AI cost control with per-company token limits and budgets.
Related
- Database Schema - 429 tables with RLS
- API Reference - Authentication and authorization
- AI Agents - PromptGuard and CognitiveLimiter
Contact security@solidnumber.com for BAA requests, security questionnaires, or penetration test coordination.