Security · measured Nov 14, 2026 · 00:19 UTC
Most security pages describe intentions. The controls below are read from the database catalogue when you load this page, so they describe the system as deployed. If someone on this team ships a table without row-level security, the number moves that day — not at the next audit.
Measured from the database catalogue at the moment you loaded this page. 1 control has no observations behind it yet and is shown as unmeasured rather than counted as a pass.
Tenancy is enforced by the database, not by a WHERE clause someone can forget. Counted from pg_catalog, so a table shipped without it moves this number the same day.
every ah_ table has row level security enabledA SECURITY DEFINER function in `public` runs as its owner and is reachable by anyone holding execute. Every one of ours lives in a private schema behind an explicit grant.
Privileged implementations live in ambition_private, never in publicAn unauthenticated caller holds execute on nothing in the private schema. Measured by asking the catalogue, not by reading the grant statements we intended to write.
anon holds execute on no privileged implementationBefore any policy is consulted, the anonymous role has no select privilege on a single tenant table. Policies are the second line here, not the first.
anon holds select on no ah_ tableNo compliance scan has been recorded in this environment yet, so there is nothing here to attribute. Reported as unmeasured rather than as a pass: a control with no observations behind it has not been demonstrated.
A caller's organisation and brand are derived inside the database from their membership rows. Nothing a client sends — no header, no body field, no query parameter — can widen what they can see, because the identity the policies consult is never taken from the request.
Every policy names the roles it applies to rather than relying on a single permissive rule. A policy written for an operator does not accidentally hold for an anonymous caller, which is the failure that turns one missing predicate into a full table read.
Functions that need to run with elevated rights sit in a private schema and are granted individually. The public schema — the only one an API client can reach — contains no privileged implementation at all, so there is nothing there to find.
Administrative surfaces require a second factor, and that requirement is evaluated in the same policies that evaluate tenancy. An application bug cannot route around it, because the application is not the thing checking.
The third figure is the one worth reading. A database test that runs as the owner never consults row-level security at all, so it proves the query works and nothing about who may run it. 325 of these suites switch into the real anon or authenticated role first and then assert what that role can and cannot reach — including 17 suites dedicated to the anonymous role specifically. This figure is generated from the suite files, so a suite that stops doing it lowers the number here.
These are structural measurements, not a certification. A passing posture means the controls described above are in force in the deployed database; it does not mean an independent assessor has reviewed them. Where a third-party attestation exists we will link it here and say who performed it and when — an unattributed badge is not evidence.
Reliability is measured separately and published on the status page, including objectives we are currently missing. The compliance rulebook and formulary that gate what a brand may publish are readable without an account at the API reference.