Security

1. Where your data lives

Your workspace data is stored in a managed PostgreSQL database in Sydney, Australia, and is encrypted at rest by our database provider. Services that process data elsewhere (for example the AI provider, when you use Rellova AI) are listed in our Privacy Policy.

2. Workspace isolation

Every workspace is separated by the database itself (row-level security), not only by the application. The app connects with a restricted login that cannot bypass that separation, and every page, action and API checks your role on the server.

3. Encryption

• All traffic uses HTTPS, and browsers are told to always use it (HSTS).
• Integration secrets (webhook addresses, API tokens and keys) are encrypted with AES-256-GCM before they are stored, and are never shown again.
• Passwords are stored only as salted scrypt hashes.

4. Sign-in and access

• Passwords of at least 12 characters; two-factor sign-in available on every account.
• Owners and admins can be required to use two-factor sign-in.
• Roles (owner, admin, builder, approver, viewer) limit who can see and change what.
• Sign-in, sign-up and password resets are rate limited.

5. Protection from abuse

• Every request is rate limited per address, and every change per person, with stricter limits on sign-in, public forms, webhooks, uploads, exports and AI.
• Automations can only call public https addresses: never internal networks or cloud metadata, with pinned DNS, timeouts and no redirects.
• A strict Content Security Policy blocks third-party and injected scripts. Uploaded files are checked by their contents and served in a sandbox.
• Form and app definitions are data only; nothing they contain is ever run as code.

6. Audit log

Sensitive actions (sign-in changes, publishing, exports, permission changes, approvals and more) are written to a per-workspace audit log that can’t be edited. Each entry is linked to the one before it with a cryptographic hash, so any change to past entries can be detected. Owners and admins can check the chain and export the log.

7. Backups and incidents

The database is backed up continuously by our provider, and we practise restoring it. We follow a written incident response plan, and we will tell affected customers about a security incident that involves their data as the law requires.

8. Compliance

We build Rellova to the SOC 2 Trust Services Criteria (security, availability and confidentiality) and keep a written set of security policies. We don’t have an independent SOC 2 report yet. If you need one for your vendor review, contact us and we’ll share our current controls.

9. Reporting a vulnerability

If you think you’ve found a security problem, please email RellovaSupport@gmail.com with the details and how to reproduce it. Please don’t access other people’s data, disrupt the service or share the issue publicly before we’ve fixed it. We’ll reply as soon as we can. Our security contact is also published at /.well-known/security.txt.