Security at Tharros
Security controls are built into the application and database boundaries rather than relying only on what the interface hides.
Organization isolation
Business data is organization-scoped in Postgres and protected with Supabase Row-Level Security policies. User-session database access is evaluated against those policies, so tenant separation does not depend on a client-side filter.
Privileged access
Service-role database credentials are server-only and are reserved for narrowly scoped internal pipelines, fixture administration, and operations that cannot run through a normal user session. They are not exposed to browser code.
Authentication and employee access
Account authentication is provided through Supabase Auth. The employee portal uses account-less, token-scoped access designed to expose only the employee and organization information required for portal workflows. Portal tokens are validated by the server on requests rather than treated as a UI-only gate.
Billing
Subscription checkout and payment-method handling are delegated to Stripe. The Tharros application stores subscription state and provider identifiers needed to enforce access, but complete payment-card details are handled by Stripe.
Operational controls
Important scheduling and administrative operations use role checks, audit records, and database-side conflict protections. Durable background work is persisted in the database instead of relying on request-lifetime fire-and-forget tasks.
Monitoring and failure handling
The application has structured server logging, error boundaries, health checks, and optional Sentry reporting. CI performs strict type checking, linting, production builds, database-backed integration tests when the dedicated test dependency is available, and Playwright browser journeys.
AI providers
AI work is split by purpose rather than routed through one unrestricted agent. Assistant generation, embeddings, and scheduling-oriented structured tasks use separate provider seams. Product code should send only the context needed for the feature being executed.
Responsible disclosure
If you believe you have found a security issue, do not access data beyond what is necessary to demonstrate the problem. Send the details to tharrosdev@gmail.com so the issue can be investigated.
No absolute-security claim
No internet service is perfectly secure. These controls describe the current engineering approach and should be reviewed and improved as the product, threat model, and customer requirements evolve.