Security
Your business data
stays your business.
ConfigBiz is built for SME operations where trust matters — payroll, stock, customer lists and money. We isolate every workspace, encrypt sensitive data and give you control over who sees what.
Security at a glance
What protects your workspace
Isolation
Every query is scoped to your workspace via RLS — no tenant can read another’s rows.
Encryption
Sensitive fields encrypted at rest; all traffic over TLS.
Access
Role-based access with least privilege — staff see only what they need.
Portability
Export your data anytime. No lock-in, no hidden retention.
How ConfigBiz secures your operation
Built on Supabase Postgres with defense-in-depth — from database policies to product controls.
Row-Level Security (RLS)
Every table enforces workspace-scoped policies. Even with a valid session, you can’t read outside your organization. Policies are tested with every migration.
Encrypted storage
Sensitive data encrypted at rest. Secrets and tokens never logged. Backups encrypted and isolated per workspace.
Role-based access
Owner, admin and member roles with per-capability and per-entity permissions. Configure who can view, create, edit or approve.
Audit trail
Who changed what, when — for configuration, approvals and data edits. Exportable for compliance or review.
Private AI
LearnBiz AI uses your description to configure your workspace. Your business data is not used to train models and never leaves your tenant boundary.
Operational controls
MFA-ready auth, session management and rate limiting. Abuse protection on public endpoints like LearnBiz.
What “no cross-tenant” actually means
Many SaaS platforms filter by organization in application code. ConfigBiz enforces it in the database. Every query includes a workspace check at the policy layer — if the check fails, Postgres returns no rows, not an error you can work around.
- Workspace id is part of every RLS policy — not just a WHERE clause in the app.
- Service keys never ship to the browser; the client uses anon key + RLS.
- Automated checks ensure new tables can’t be created without policies.
Your responsibilities — kept simple
Security is shared. We handle platform controls; you control access.
Have a security question?
If you need a DPA, data processing details or want to discuss a specific compliance need, we’ll answer as a business advisor — clearly and without enterprise jargon.