Security & architecture
Written for the person who has to sign off on us. Every claim below names the mechanism behind it, and the last section lists what Cevoriq does not claim — because the fastest way to lose a security review is to be caught overstating one thing while everything else was true.
| Tenant isolation | PostgreSQL row-level security | Isolation is enforced by the database, not by application code remembering to add a WHERE clause. Policies are attached to the tables themselves and forced on, so a query that forgets its tenant returns nothing rather than everything. |
|---|---|---|
| Authentication | Clerk | Credentials, MFA and sessions live with the identity provider. Cevoriq stores no passwords. A sign-in never passes a password through Cevoriq's servers. |
| Authorisation | Roles held in Cevoriq | Who may sign in is the identity provider's decision; what they may do is Cevoriq's. Membership and role are recorded per tenant, and module access is granted per member. |
| Hosting | Vercel, one deployment per region | Each region is served by its own deployment: cevoriq.com for US East (Virginia) and eu.cevoriq.com for EU Central (Frankfurt). Application compute for every region currently runs in the United States, so data stored in another region is still processed in the US. See the region table below. |
| Database | PostgreSQL 17 | Managed Postgres with pgvector for the embedding-backed features. Each region has its own database: US East (Virginia) on Supabase and EU Central (Frankfurt) on Neon. |
| Object storage | Cloudflare R2 | Contract documents and uploads. Objects are written and read server-side through signed URLs; the browser never holds a storage credential. |
| Stored secrets | AES-256-GCM | Where you supply your own AI provider key, it is encrypted at rest with an authenticated cipher and decrypted only to make the call you asked for. |
| Audit trail | Who, what, when, and the values | Create, update and delete are recorded with the actor, the entity, and the old and new value of each changed field — not merely that something changed. |
The isolation is tested adversarially, on every change
Cevoriq has a reporting feature that lets a language model query your data directly. That is a real risk, so it is defended by the database rather than by trusting the model: the reader connects as a restricted role, the tenant context is sealed so it cannot be forged, and row-level security decides what is visible.
A suite of 28 adversarial queries — attempts to read across tenants, to escalate, to forge the tenant context — runs in continuous integration and fails the build if any one of them returns data it should not. It is deliberately separate from the reporting scans, which collect findings without blocking, because a security boundary that reports green while broken is worse than no check at all: the green tick is what stops anyone looking.
Backups that have to prove themselves
A nightly job dumps the production database, restores that dump into a throwaway PostgreSQL, and compares a row-count digest against the source. If the restore fails or the digest differs, the job fails and nothing is published — because an untested backup is a belief, not a capability.
The dump is encrypted before it is stored, and the identity directory is exported and encrypted alongside it, so a recovery can re-link people to their restored records rather than restoring rows that point at identifiers no longer in existence. A failed run raises an alert to a human; it does not simply go red in a log.
Where your data lives
2 regions are live today. The rest are on the roadmap and are refused if selected. Offering a region is a reviewed change in our repository, an automated check fails if an offered region has no production database registered for backup, and an organization can be created in a region only where that region's database and file storage are both configured.
AI recommends. Your team decides.
Cevoriq's AI recommendations are proposals by default. Each one records the inputs it used and the reasoning it gave, and a person approves or rejects it.
There is one exception, and your team has to opt in to it. If you choose AI auto-assignment for Field Service work — on an individual dispatch, or in a dispatch rule — and the routing recommendation's confidence meets your organization's auto-execute threshold, the recommended service partner is assigned without a further approval step, and the decision is recorded as automatically executed. The threshold is 90% unless an administrator changes it in Settings; setting it to 0 means nothing is assigned automatically. Dispatch rules default to the self-pick pool, where partners choose whether to accept the work.
You may also supply your own AI provider key, in which case your data goes to your account with your provider, under your agreement with them, rather than through ours.
Taking your data with you
Owners and administrators can export everything Cevoriq holds for their organisation, with attachments, at no charge. Read the exit procedure.
Found a vulnerability?
Report a vulnerability — how to reach us, what is in scope, and how good-faith research is treated.
What Cevoriq does not claim
- No point-in-time recovery. Recovery is from the most recent nightly backup, so the worst case is a day of data. Say so in your risk assessment rather than assuming continuous recovery.
- 2 regions today. Data residency outside US East (Virginia) and EU Central (Frankfurt) is roadmap, and selecting another region is refused rather than silently accepted.
- No in-region processing. Choosing a region decides where your data is stored. Application compute for every region currently runs in the United States, and some providers process data outside your region; the data residency page lists each one.
- Retention periods are recorded, not yet automatically enforced. The setting is shown read-only for that reason. An audited instruction to delete that the platform did not carry out is evidence against the platform, so it is not presented as something it is not.
- No third-party certification yet. There is no SOC 2 report or ISO 27001 certificate to hand you. What is above is what exists, described precisely enough to verify in a technical review.