Security and tenant separation
Every business is a tenant. The database itself enforces the separation of tenants, and a test checks it across all tables.
What Security and tenant separation gives you
Tenant separation in the database
PostgreSQL separates businesses with row-level security. It is switched on and enforced for all tables. The application connects with a role that is neither owner nor superuser and cannot bypass the rules.
Tested
A catalogue test reads the schema and checks 18 rules. A separate test suite attacks the separation.
Password, app code, passkey
Passwords are stored with argon2id. As a second factor there is an app code (TOTP) with ten recovery codes, or a passkey. The app code's secret is stored in the database only in encrypted form.
Devices and sessions
A session belongs to one business and one device. It can be ended at once. Failed sign-ins are limited: after five failed attempts per account within 15 minutes, further attempts are refused.
Unchangeable documents
Issued quotes and invoices can be neither changed nor deleted, not even through the application's role.
AI only with approval
The assistant has no tool for sending, deleting or paying. The server enforces that, not the prompt.
What we do not claim
hauscloud holds no certification. Where data is stored depends on how it is operated; we make no promise about location here. Within a business there are no roles in version 0.2.0: every signed-in member may issue documents. Accounts are created by the operator; changing a password and managing passkeys are not yet part of the app.
Works well with
Want to get to know hauscloud?
The pre-release is not open to everyone yet and sales are closed. Write to us and we will reply with the current state.