Security & Trust

How your data is kept separate from every other tenant's

Every business on Harvest OS shares the same database, but each table has a rule attached directly to it, enforced by the database itself (Postgres row-level security), not by application code checking "does this belong to the right tenant" on each page. That distinction matters: if a page had a bug and forgot to filter by tenant, most software would leak another customer's data anyway - the database rule is what stops that here, because the database refuses to return rows that don't match regardless of what the requesting code asked for.

This isn't just a design intention - it's checked by an automated test suite before every deployment, and by a database function that lists every tenant-scoped table and confirms a policy actually exists on it, so a new feature can't quietly ship without this protection. If you or your own technical staff want to verify this rather than take our word for it, ask us - we can walk through the actual database policies and the test that checks them.

One documented exception: our public API and outbound webhooks (used only if you connect a third-party system) authenticate differently and re-check tenant ownership in application code instead of a database rule, since there's no signed-in session for an external system to key that rule off. That path has its own separate automated test verifying it can't cross tenant lines either.

What happens to your data if you cancel

You own the business data you enter - inventory, orders, production records, and similar. If you close your tenant, that data is deleted on request, subject to any legal retention requirements (some transaction records may need to be kept for a period under tax or financial regulation regardless of what either of us wants).

Honestly: closing a tenant is not yet a self-service "delete my account" button - today it's a request you make to us directly (see contact below), and we handle the export and deletion. There is no published guaranteed turnaround time for this yet.

You don't have to wait for that to get your own data out, though - several exports are available to you right now, no request needed: a month-end financial CSV export, a full audit-log export, and, on the Pro plan, the developer API (/api/v1/*), which can pull your inventory, orders, and production records directly into your own systems at any time.

Who to contact about a security concern

Email info@frontiercatalyst.com.ng directly for a vulnerability report, a data question, or anything else security-related. That's a general team inbox, not yet a dedicated, staffed security function with a published response-time commitment (see below) - but it is read by people who can act on a real report, and we'd rather hear about a problem than have it found for us.

How the basics are handled

• Passwords are never stored in plain text - only as a salted hash.
• Every connection to Harvest OS is encrypted in transit (TLS); this is enforced by our hosting infrastructure (Vercel and Supabase), not something a bug in this codebase could turn off. The underlying database is hosted on infrastructure that encrypts data at rest by default - that's a property of the hosting platform, worth confirming directly with Supabase's own documentation rather than taking it secondhand from us.
• Access within a tenant is role-based (owner / manager / staff) - for example, only an owner or manager can see the finance dashboard or payment reconciliation, and that's enforced on the server for every request, not just hidden from the menu.
• Every change to stock, orders, payments, and production records is logged with who made it and when, viewable and exportable by the tenant owner at any time (/audit-log).
• Automated backups run daily, and the restore procedure has been drilled for real at least once (restoring a backup into a fresh project and verifying tenant isolation survived intact) - not just designed and left untested.