Audit trail
Every read, write, and admin action lands in security_events.
Authentication & authorization
Bearer JWT, MFA, step-up auth, break-glass, session policies.
Compliance
Cross-link to SOC 2, ISO 27001, GDPR, PCI, and residency controls.
Encryption
AES-256-GCM field encryption, Vault-wrapped DEKs, KEK rotation.
RLS policies
How row-level security is enforced in Supabase Postgres.
Secrets management
Supabase Vault, per-tenant namespaces, key rotation cadence.
Tenant isolation
Four layers of defense — RLS, JWT claims, Vault, network — verified by tests.
Vulnerability disclosure
Coordinated disclosure policy, PGP key, response SLA.