Security
What we do today.
This page lists facts only. If something is not here, we do not claim it.
In place today
Role-based access
Agents, team leaders and administrators see different things. Permissions are checked on the server and again in the database.
Row-level security
Every table in the database has row-level security turned on. The browser cannot write sensitive data directly.
Optional two-step verification
Anyone can protect their account with an authenticator app.
Audit log
Sensitive actions are recorded: who did what and when.
Secrets stay on the server
The keys that can bypass access rules are used only on the server, never in the browser.
Encrypted connections
All traffic uses HTTPS with HSTS and standard security headers.
Automated security tests
Database access rules are tested automatically on every change.
No client data in rankings
Leaderboards and shared images show names and approved annual premium only.
Where it runs
Hosting: Vercel. Database, authentication and file storage: Supabase. Transactional email: Resend.
What we do not claim
- No third-party security certification yet, such as SOC 2.
- No claim of HIPAA compliance.
- RORU App does not send SMS or make calls.
Need a security questionnaire answered? Request a demo and ask for it.