Security Model
How Kredal isolates tenants and protects sensitive documents.
Kredal handles passports, Emirates IDs, and UBO declarations. The security model is tenant-isolation-first, enforced in the database rather than only in application code.
Row-Level Security on every table
Every table has RLS enabled. Reads are scoped to workspace membership; a user can only ever
see rows belonging to a workspace they are a member of. The check is centralised in
security-definer helper functions so policies do not recurse into workspace_members' own
RLS (the standard Supabase multi-tenant pattern):
is_workspace_member(ws_id)— used by allselectpolicies.is_workspace_writer(ws_id)— owner/admin/member (not viewer); used by insert/update.is_workspace_admin(ws_id)— owner/admin; used by deletes and member management.
Roles
Consultant workspaces support four roles: owner, admin, member, viewer.
Viewers are deliberately read-only — they can see a client's file but cannot upload, edit,
add owners, or run assessments. This was tightened during the security review: the viewer
role originally had the same write access as member, which was a real gap now closed by
is_workspace_writer.
Private storage & signed URLs
Documents live in a private company-documents bucket. There is no public URL. Access is
granted only through short-lived (120s) signed URLs generated server-side for an
authenticated, authorised workspace member. The storage RLS policies check workspace
membership on the first path segment ({workspace_id}/{company_id}/...).
Service-role isolation
A service-role Supabase client exists for privileged server-side work (signed URL
generation). It is loaded through a server-only module so it can never be imported into a
client component. All ordinary data access uses a per-request client that runs as the
user, so RLS is always in force.
Append-only audit log
audit_events has an insert policy but no update or delete policy — RLS denies mutation
by default. Company creation, document uploads and deletions, questionnaire changes,
assessments, and report generation each write an audit row.
Verifying it
Run the Verify RLS runbook before any pilot: cross-tenant read isolation, signed-URL expiry, viewer read-only enforcement, unauthenticated redirect, and audit-log immutability.
Data-handling commitments
Documents are encrypted at rest, stored privately, deletable by the user at any time, and are
not used to train AI models. These commitments are stated on the product /security page.