Can another customer reach my records?
Tenant boundaries should be enforced at the database layer, not only by hiding records in the interface.
Security & Platform How we protect
How we protect
your business data.
Security starts with one question: can the wrong user or organization reach data they should not see? RomyLabs products are designed around tenant isolation, role-based access, private storage, encrypted transport, server-side secrets and auditable administrative controls. We state only what is implemented and do not claim certifications we have not independently verified.
Database-enforced tenant isolation
RomyLabs products use tenant-aware database policies, including PostgreSQL Row Level Security where implemented, so organization boundaries are enforced at the data layer rather than relying only on screen-level application logic.
Authentication and sessions
Products use managed authentication with cryptographically signed sessions. Passwords are not stored in plaintext. Session and account controls are kept separate from public marketing experiences.
Role-based access control
Product permissions are designed around job responsibility. Owners, administrators, managers, staff and field or clinical roles receive different access according to what each workflow requires.
Private files and signed access
Products that handle customer, patient, claim, case or association files use private storage patterns and controlled file access. Sensitive files are not intended to be exposed as permanent public URLs.
Encryption in transit
HTTPS is enforced across public product domains and application traffic is protected in transit using modern TLS through the hosting and platform providers used by each product.
Auditability
Where supported by the product workflow, sensitive actions and administrative changes are logged so organizations can review who performed an action and when.
Least-privilege infrastructure access
Administrative and service credentials are separated from normal end-user access. Provider keys and privileged service roles are kept server-side and are not intended to be exposed in browser code.
Account lifecycle and recovery
Invites, password recovery, role changes and deactivation are handled through authenticated product flows. Multi-factor authentication availability is product-specific; RomyLabs does not claim MFA is mandatory across a product unless it is actually enforced there.
Backup and recovery
RomyLabs relies on managed database and infrastructure providers with backup and recovery capabilities. Product recovery procedures are treated as operational controls and are reviewed alongside deployment and incident-response work.
Incident response and customer data requests
Confirmed security incidents are investigated, contained and communicated to affected customers as appropriate. Customers may also request access, correction, export or deletion of their data subject to product, legal and retention requirements.
Security testing and hardening
RomyLabs uses authorization, tenant-isolation, storage, and regression checks as part of product hardening. Findings that affect data access or privilege boundaries are treated as release blockers.
What buyers should ask
Security questions a serious CRM buyer should be able to answer.
Are documents public?
Sensitive files should use private storage and controlled access rather than permanent public links.
Who can change permissions?
Administrative actions should be restricted to authorized roles and, where supported, recorded for later review.
Where do provider secrets live?
Privileged keys and service credentials belong on the server side, not in browser-managed settings or public source.
What happens when an employee leaves?
Organizations need a clear process to disable access and prevent former staff from retaining access to customer data.
What is independently certified?
We separate implemented controls from certifications. RomyLabs does not advertise SOC 2, ISO 27001, HIPAA or other certifications unless independently verified.
Platform stack
Technology we rely on.
RomyLabs uses established infrastructure providers, but the provider name is not the control. The important part is how our products use those services: tenant-scoped database policies, private storage, encrypted connections, restricted service credentials and controlled deployment workflows.
Cloudflare
Frontend delivery, DDoS protection, TLS, and CDN. All product frontends deploy through Cloudflare Pages.
Supabase / PostgreSQL
Database, authentication, real-time subscriptions, and serverless edge functions. Row Level Security enforced at the database layer across all products.
GitHub
Source code management and CI/CD pipelines. Code is reviewed before deployment. No direct push to production without a build and deployment pipeline.
Stripe
Payment processing where Stripe is used. Card details are handled through provider-managed payment flows rather than intentionally stored as raw card data in RomyLabs application databases.
Security contact.
If you believe you have found a security vulnerability in any RomyLabs product, please contact us directly. Do not publish or share the issue publicly until we have had the opportunity to investigate and address it.
Contact RomyLabs →