Security at Soviic
Soviic connects to the tools your business runs on, so protecting that access is the product. Here's how we do it, in plain language.
Encryption at rest
Credentials for connected tools (like Gmail and Slack) are protected with envelope encryption: each token is encrypted with its own data key, which is itself encrypted by a master key held in a secrets vault. Plaintext tokens never leave trusted server-side code and are never sent to your browser.
Tenant isolation
Every record belongs to an organization, and the database itself enforces who can read it using row-level security. Isolation isn't a filter our app remembers to apply — it's a rule the database applies to every query.
Multi-factor authentication
Accounts can enrol an authenticator app for a second factor at sign-in. Sensitive role changes are performed server-side and can only be made by an organization owner — nobody can change their own permission level.
Secrets and least privilege
Sensitive columns, such as webhook signing secrets, are not readable by the app's own signed-in database role. They are revealed only on demand to owners and admins through an audited server-side path.
Responsible disclosure
We welcome reports from security researchers. If you believe you've found a vulnerability in Soviic, please tell us before disclosing it publicly, and give us a reasonable window to investigate and fix it. Please avoid accessing other people's data, degrading service for others, or running automated scanning that generates heavy load. We'll acknowledge good-faith reports and won't pursue action against researchers who follow these guidelines.