Written for customers, their IT teams, and procurement. It describes Rople's actual security posture, including where work is still in progress — an overview that only lists strengths is not useful to a buyer.
1. Architecture
Rople is a multi-tenant SaaS platform. Next.js on Vercel, managed Postgres and object storage on Supabase, all customers on shared infrastructure with logical isolation at the database layer.
2. Tenant isolation
This is the control that matters most in a multi-tenant people platform.
- Every tenant-scoped table carries
org_id. - Row-level security policies are enabled in Postgres so a query issued in one workspace's context cannot return another's rows.
- Application requests run on user-scoped database clients that carry the caller's identity, so RLS is evaluated against a real principal rather than bypassed by a privileged key.
- Module access is gated per workspace. A module not enabled for a workspace is not reachable from it and returns not-found rather than forbidden, so the existence of another customer's bespoke module is not disclosed.
- Authorisation inside a workspace is role- and seat-based.
- Cross-tenant isolation is covered by an automated two-organisation test suite run in CI.
3. Authentication
- Managed by Supabase Auth (GoTrue).
- Passwords hashed with bcrypt. Never stored in plaintext, never logged, never emailed.
- Workspace owner setup and team joining use single-use, expiring tokens, not transmitted passwords.
- Invite links support expiry, usage caps, revocation, and optional email-domain restriction; every redemption is recorded.
- Session tokens are httpOnly cookies with short-lived access tokens.
- MFA: [planned — target date].
- SSO / SAML: [planned — available on enterprise plans, target date].
4. Encryption
| In transit | TLS 1.2+ everywhere, HSTS enabled |
| At rest | AES-256 for database and object storage |
| Secrets | Environment variables in the hosting platform's encrypted store; never committed to version control |
5. File storage
Private buckets. No public read. Access only through short-lived signed URLs issued after an authorisation check scoped to the requesting workspace.
6. Logging and monitoring
- Audit log of significant actions — actor, action, entity, timestamp, metadata — retained [24] months and readable by workspace admins for their own workspace.
- Error and performance monitoring via Sentry.
- Product analytics via PostHog, with text input masked by default.
- Authentication events retained [90] days.
7. Backups and recovery
- Managed Postgres with point-in-time recovery.
- Backups retained [35] days, encrypted at rest.
- Restore procedure documented; restore test performed [quarterly].
- RPO target [24 hours], RTO target [8 hours].
8. Development and change management
- All code in version control, changes via pull request with review.
- Database migrations applied through a ledgered migration runner, so what has run against an environment is recorded and ordered.
- Automated linting, type checking and test suite in CI.
- Staging environment before production.
- Dependency vulnerability alerts enabled; secret scanning enabled on the repository.
9. Rople staff access
- Least privilege. Production data access granted on need, not by default.
- A separate administrative surface requiring elevated authentication, with actions written to the audit log.
- All staff and contractors under confidentiality obligations, briefed on data protection at joining, access revoked on their last working day.
10. Incident response
- Detect and triage.
- Contain and remediate.
- Assess scope and affected customers.
- Notify: the NDPC within 72 hours where the NDPA requires it; affected customers without undue delay and in any event within 48 hours of confirming their data is affected.
- Written post-incident report to affected customers.
Security contact: [SECURITY EMAIL].
11. Compliance
| NDPA 2023 | Aligned. NDPC registration: [STATUS] |
| GDPR | DPA with SCCs available for customers in scope |
| PCI DSS | Out of scope — card data is handled entirely by Paystack / Flutterwave |
| SOC 2 / ISO 27001 | Not certified. [Planned — target date] |
We do not claim certifications we do not hold.
12. Known work in progress
Stated plainly because buyers will ask, and because an internal architecture audit identified them:
- Migration of remaining privileged-key database paths onto user-scoped clients, so RLS is enforced rather than bypassed on every route. In progress.
- Completion of the module registry and entitlement tables as the single gate for module access. In progress.
- MFA and SSO. Planned.
- Independent penetration test. Planned — [target date].
A current status for any of these is available on request.