Built multi-tenant. Designed for isolation.
RiVara treats organization boundaries as a product requirement — not an afterthought. Conversations, knowledge, and bookings stay scoped to your workspace.
Controls we prioritize
How we protect customer data
Organization isolation
Queries and RAG retrieval filter by organization_id so tenants cannot read each other’s data.
Authentication & RBAC
JWT auth with role-based access for platform admins, org admins, and staff.
Secrets hygiene
API keys and SMTP credentials load from environment configuration — never hard-coded in app logic.
Transport security
Production deployments are designed for HTTPS, secure cookies, and controlled CORS.
Input validation
External payloads are validated before business operations run.
Operational logging
Structured logs for diagnostics without writing passwords or tokens.
Honest posture
We document what is shipped versus roadmap. Ask for a questionnaire if you need SOC2 timelines, BAAs, or vendor risk packets.
Security questionnaire?
Contact us and we will route the right materials for your procurement process.