Row-level security with WITH CHECK
Policies block reads and tenant-id-leaking writes. A CI gate runs on every PR: open a connection without SET LOCAL app.tenant_id and assert zero rows leak from any tenant table.
Security
The facts an InfoSec reviewer needs.
Architectural detail you can paste into a vendor questionnaire - not platitudes. Each claim ties to a verifiable control in the codebase.
Encrypted at rest · TLS 1.2+ in transit
Cloud SQL and Cloud Storage encrypt at rest with Google-managed keys. The database has no public IP - Cloud Run reaches it over a private VPC connection. Buckets run uniform bucket-level access, so a stray object ACL cannot widen a grant.
DB-trigger immutability
A Postgres trigger raises on UPDATE / DELETE against audit_logs. Even a compromised admin can't rewrite history.
Daily backup · 7-day point-in-time recovery
Cloud SQL backs up daily at 03:00 UTC and keeps the last seven, with seven days of transaction logs for point-in-time recovery. The uploads bucket keeps object versions.
Magic-link + JWT
Single-use random tokens (sha256-hashed in DB), 24h TTL. JWT issued only after password set.
SOC 2 Type I in progress · pen-test quarterly
Annual ISO 27001 posture review. GDPR / HIPAA region pinning available. BAA on Enterprise.
Try it on your own document.
Upload a CoA, watch the engine cite the failing clause.