01
Tenant and authority boundaries
Rootsly is one multi-tenant application. Tenant-owned rows carry an organisation identity and access is enforced by Postgres row-level security plus server authorisation—not by the host name, logo or a hidden user-interface control alone.
Privileged functions re-check role, organisation, account state and recent verification where required. The Supabase service-role credential is never shipped to browser code.
- Same-tenant allow and cross-tenant deny behaviour is tested for data-bearing work.
- Support access is temporary, explicit and audited.
- Referral source and receiver views are restricted projections rather than unrestricted access to one shared row.
02
Staff authentication
Staff account verification and sign-in use six-digit email codes, not clickable magic links. An authenticator can be enabled as optional stronger account security and sensitive operations can require recent higher-assurance verification.
Account and feature controls can suspend access, revoke sessions and limit a tenant or operation without changing historical evidence.
03
Data, files and secrets
Chimnie, Resend, Supabase service-role, webhook and other secrets stay in environment-specific server configuration. Personal data, access tokens, consent wording and report contents are excluded from routine logs and analytics.
Reports, photos and exports use private storage and bounded signed or server-authorised access. File type, size, metadata, access and removal rules are defined before an upload category is enabled.
04
Durable operations and incidents
Email, reports, referrals, fee events and webhooks use idempotent, retryable work with observable failure and manual recovery. Test mode is separated from live email, paid property calls and referral transfer.
The incident process supports session or key revocation, feature or tenant isolation, evidence preservation, impact analysis, client coordination, legally guided notification and post-incident review. Emergency contacts and the process require a recorded pre-pilot exercise.
05
Report a suspected security issue
Security reports use security@rootsly.co.uk and the separate responsible-disclosure route. Rootsly does not currently offer a bug bounty or permission for intrusive testing.
Do not send secrets or homeowner data in the first report, and stop if testing could expose information, interrupt service or affect another user.