Security

Built multi-tenant. Designed for isolation.

RiVara treats organization boundaries as a product requirement — not an afterthought. Conversations, knowledge, and bookings stay scoped to your workspace.

Controls we prioritize

Tenant isolationAccess controlEncryption in transitAudit trails

How we protect customer data

Organization isolation

Queries and RAG retrieval filter by organization_id so tenants cannot read each other’s data.

Authentication & RBAC

JWT auth with role-based access for platform admins, org admins, and staff.

Secrets hygiene

API keys and SMTP credentials load from environment configuration — never hard-coded in app logic.

Transport security

Production deployments are designed for HTTPS, secure cookies, and controlled CORS.

Input validation

External payloads are validated before business operations run.

Operational logging

Structured logs for diagnostics without writing passwords or tokens.

Honest posture

We document what is shipped versus roadmap. Ask for a questionnaire if you need SOC2 timelines, BAAs, or vendor risk packets.

Security questionnaire?

Contact us and we will route the right materials for your procurement process.