Security architecture

Scoped access, auditable changes, and explicit trust boundaries

SignaGenius combines tenant isolation, server-side authorization, revocable credentials, and durable audit trails. This page describes implemented controls without claiming certifications that have not been independently awarded.

Start a workspace Read the setup guide

Tenant isolation

Workspace records are scoped by organization with database row-level policies and server-side target checks.

Service credentials remain server-only
Explicit browser read grants
Entity-scoped administration

Hosted activation varies

Authentication

Password recovery, TOTP enrollment and challenge, passkey account controls, idle-session policy, and SSO enforcement gates.

Least-privilege integrations

Connector capabilities are executed only when the provider and required credentials are configured.

Encrypted connector envelopes
Pinned SFTP host keys
Revocable agent credentials

API protection

Customer keys are hashed, scoped, rate-limited, and shown once; batch retries are tenant-bound and request-hashed.

Webhook integrity

Outbound events are signed, retried durably, and recorded with delivery history for operational review.

Audit and recovery

Administrative changes, deployment outcomes, synchronization jobs, and retry queues preserve evidence for investigation.

Immutable template versions
Secret-free workspace export
Operational failure histories

No SOC 2, ISO 27001, HIPAA, PCI, or other third-party certification is asserted here. Production assurance still requires deployment-specific security review, Supabase advisors, backup/restore exercises, dependency monitoring, and provider validation.