Platform Security

Row-Level Security (RLS) enforced on every tenant table. Cross-workspace reads and writes are blocked at the database, not just the application layer.
Role-Based Access Control (RBAC) via a dedicated user_roles table and has_role() security-definer function — roles cannot be edited by the user they gate.
Every server function that mutates data is authenticated and scoped to the caller's session; privileged operations require an explicit role check before the admin client is loaded.
Webhooks (billing, email) verify HMAC signatures with a timing-safe comparison against a per-provider secret.
Automated end-to-end RLS test suite (run_rls_test_suite) verifies cross-tenant isolation and is runnable from the in-app RLS Verification page.

Privacy & Data Protection

Revenue Recovery Labs collects only the data required to operate the Recovery Engine: your workspace configuration, integration credentials (encrypted), and the payment failure / recovery events streamed from your billing provider. We do not sell or share customer data.

Customer data is logically isolated per workspace via RLS.
Email recipients can unsubscribe or manage preferences via HMAC-signed links; opt-outs are honored across billing and analytics categories.
Audit logs record workspace-scoped state changes for accountability.
See also our Privacy Policy and Cookie Policy.

Encryption

In transit: TLS 1.2+ enforced end-to-end. TLS terminates at Cloudflare's edge and the connection to the origin is re-encrypted.
At rest: Managed Postgres storage encryption via the database provider. Object storage buckets are private by default.
Application-layer: Third-party API credentials (Stripe, Lemon Squeezy, Shopify, WhatsApp) are encrypted before persistence using AES-256-GCM with a workspace-scoped derivation.

Infrastructure

Application: Vercel edge / serverless deployment for the marketing site; Cloudflare Workers for server-side rendering and API endpoints.
Database & Auth: Managed Postgres with Row-Level Security and per-project isolation.
Edge: Cloudflare for DNS, DDoS mitigation, WAF, and TLS.
CI/CD: GitHub Actions pipeline with pre-deploy validation and rollback capability.

Subprocessors

We use the following subprocessors to deliver the service. Each is bound by its own data processing terms. Material changes to this list are announced in-product prior to taking effect.

Subprocessor	Purpose	Region
Supabase	Managed Postgres, authentication, and object storage.	US / EU
Cloudflare	Edge network, DNS, DDoS protection, TLS termination.	Global edge
Vercel	Static hosting and serverless deployment for the marketing site.	Global edge
Resend	Transactional and lifecycle email delivery.	US / EU
Lemon Squeezy	Merchant of Record — billing, invoicing, tax remittance.	US
OpenRouter	LLM inference for automated recovery messaging.	US / EU

Responsible Disclosure

We welcome coordinated disclosure from the security research community. If you believe you have found a vulnerability, email [email protected] with steps to reproduce. We acknowledge reports within one business day and will keep you informed until the issue is resolved. Please avoid data exfiltration, service disruption, and social engineering while researching.

Incident History

No reportable security incidents to date. Live service health and any active or recent incidents are published on our Status page.

Backup & Disaster Recovery

Managed Postgres backups are performed by our database provider on their published cadence, with point-in-time recovery available.
Application code and configuration are versioned in Git; every production deploy is reproducible from a specific commit.
Infrastructure is stateless at the edge — a full region failover requires only re-pointing DNS to a healthy edge.
We do not publish specific RTO / RPO figures at this time; contact us for enterprise contractual commitments.

Compliance Roadmap

Revenue Recovery Labs does not currently hold third-party security certifications. Our roadmap is aspirational — no dates are committed — and we will publish evidence (badge + audit report availability) once each is complete.

SOC 2 Type II — planned; controls being implemented.
ISO/IEC 27001 — under evaluation.
GDPR — we operate consistent with GDPR principles for European customers; a formal DPA is available on request.
PCI DSS — scope minimized: card data is handled entirely by our merchant of record (Lemon Squeezy); we never touch PAN.

Security Contact

For vulnerability reports, security questionnaires, DPAs, or subprocessor inquiries, email [email protected].