Security
Security, stated plainly.
Savicor holds confidential business information, so security is part of how the data model works. This page lists what is in place and what is not.
Mandatory two-factor authentication
Every account must add an authenticator app. Database policies refuse business data to any session that has not completed the second factor. Recovery codes are stored hashed.
Tenant isolation in the database
Every table that holds organisation data has Row Level Security. Server code runs through the same policies as any client. Automated tests check that one organisation cannot read, change or receive realtime events about another.
Five roles and least privilege
Owner, admin, manager, member and read-only. Members see their own deals unless the organisation shares them; read-only users cannot write; exports need manager rights or higher.
Audit log
Creates, changes, archives and deletions are recorded by database triggers, with who did it and what changed. Admins can review it.
Web protections
Strict Content Security Policy with per-request nonces, HSTS, frame denial, rate limits on sign-in and public forms, and sanitised rendering of inbound email in a sandboxed frame.
Secrets stay on the server
Privileged keys are used only by background jobs and webhooks, never in browser code. Invitation tokens are stored as hashes.
Not in place yet
What we have not done yet.
Listed here so you can decide with the full picture.
- No independent security audit or certification (such as ISO 27001 or SOC 2) has been done.
- Production hosting is designed for the EU (Supabase in Frankfurt, Vercel EU); confirm the region for your account before storing personal data.
- Single sign-on (SAML) is not available.
Found a vulnerability?
Use the contact form and choose Security report. Please do not test against other customers' data.