Security
How RenewalOS protects your data.
Your workspace is isolated
Every table is protected by row-level security in the database. A signed-in user can only read or change rows that belong to a workspace they are a member of.
Roles are enforced where it counts
Owner, admin, member and viewer permissions are checked by the database, so a hidden button is never the only thing standing between a viewer and an edit.
Plan limits cannot be bypassed
Seat and record limits are enforced by database rules, and a workspace's plan can only change after a verified payment event from Stripe.
Files stay private
Attachments live in a private bucket and are shared only through short-lived signed links.
Payments never touch our servers
Card details are handled entirely by Stripe. Webhooks are verified by signature and processed once.
Safe by default
Passwords are handled by Supabase Auth. Sign-in and sign-up are rate limited, CSV exports neutralize spreadsheet formulas, and all pages are served over HTTPS.
To report a vulnerability, email the address listed on your account's support page.