Security is
architecture, not a badge.
Relpin enforces isolation, identity, and least privilege at the platform level — fail-closed by default. We are in open beta and hold no certifications yet. What we have today is the architecture below.
DB-per-org Postgres; per-app isolated Workers
Spoofable headers stripped; identity injected server-side
Runtime and DDL roles separated; scoped grants
Row-level history enforced at DB-privilege level
Every org runs in its
own blast radius.
Isolation is structural, not a filter on a shared table. Each organization gets a dedicated Postgres database, per-workspace and per-environment schemas, and its own isolated runtime — separated by least-privilege roles at every layer.
Each organization gets a dedicated Postgres database. There is no shared multi-tenant table to leak across.
Apps deploy as isolated per-tenant Cloudflare Workers on Workers for Platforms — one app cannot reach another.
Runtime roles and DDL roles are separated. Tenant code never runs with schema-altering privileges.
Operators cannot sign
into your apps.
Product surfaces and the operator console run on separate authentication domains. Operator access is recomputed against an allowlist on every request, so revocation takes effect immediately — and operator credentials can never authenticate into a customer app.
Customer apps and Studio surfaces. Verified org members only.
Operator console. Allowlist recomputed per request; revocation is immediate.
The product and the operator console are distinct trust boundaries with distinct credentials.
Operator authorization is recomputed on every request. Revoking access is immediate, not eventual.
Operator credentials cannot authenticate into customer apps — the two domains never trust each other.
Credentials stay
platform-side.
User code references secrets; it never receives their values. Database credentials and provider secrets stay server-side and never reach the browser, user code, or logs. Container preview gets credentials through an isolating sidecar, and every access is audited.
Apps hold secret references, not secret values. The plaintext never leaves the platform boundary.
Credentials are not exposed to the browser, injected into user code, or written to logs.
Container-backed live preview receives credentials through a credential-isolating sidecar proxy.
Every scoped request
is checked server-side.
Permission keys are evaluated on the server before an action runs — the browser never holds the decision. Custom roles use pattern grants, per-app runtime policies decide who can reach each app, and managed accounts are bound to claimed email domains.
Every scoped request resolves a permission key on the platform before the action executes.
Org-defined roles grant access by global, exact-key, or prefix-wildcard patterns.
Runtime access scopes to role, named users, workspace, or editors-only — enforced at the edge.
Append-only history,
enforced by the database.
Every user table captures field-level before/after diffs with the acting identity on insert, update, and delete. The audit table is append-only — enforced by database privileges, not application convention. Operational guardrails fail closed by default.
Tenant roles get SELECT and INSERT on the audit table only. History cannot be edited or deleted.
Triggers capture before/after values and the actor on every insert, update, and delete.
Statement and lock timeouts, pagination caps, per-org concurrency limits, and fail-closed quotas are defaults.
What we have, and
what we do not.
Honesty is part of the posture. We will not claim certifications we do not hold or controls we have not built.
Relpin holds no SOC 2, ISO 27001, or HIPAA certifications today. Compliance reporting is planned. What exists today is the architecture above.
Architecture you can
inspect before you trust.
Relpin gives engineering and platform teams isolation, verified identity, and least privilege as platform defaults — not as a checklist bolted on later.
Tenant isolation · Verified identity · Least privilege · Append-only audit
Open-beta product. Architecture-level guarantees. No certifications claimed.