Controls
Infrastructure security
Tenant isolation with row-level security
In progressCriticalVerified 15 September 2026ST4S S4, A13, PR14
What this control means
Tables holding personal data are protected by Postgres row-level security scoped to the signed-in user and their school. Privileged keys never reach the browser.
What we found
Row-level security is enabled on all 121 tables. Policies exist on 47; the rest are reachable only by the server. Not yet fully proven.
How we verified it
- Queried the production catalogue: 121 of 121 tables have row-level security enabled, none forced.
- 47 tables carry explicit policies; 74 have none, which means browser roles get nothing and only the server can read them.
- Exported every policy that grants to anonymous or public roles and reviewed each one by hand.
Still to do
- Classify each table as holding personal data or not, and document how server code scopes the ones without policies.
- Remove a small number of over-broad policies found in the review.
- Cross-tenant read test from a demo account, recorded.
Evidence (private, draft only): kuraplan-st4s-evidence/01-infrastructure/2026-09-15-rls-inventory.md
Questions about this control: security@kuraplan.com