Authorization lives with the data.

RigorFrame uses tenant-scoped PostgreSQL tables, forced row-level security, a granular permission matrix, append-only audit records, version-protected evidence, and governed approval functions. Frontend visibility checks are usability controls; the database remains the authorization boundary.

Implemented controls

• Managed authentication with organization workspaces and branch-isolated identity data
• Forced row-level security across every RigorFrame tenant table
• Owner/admin base roles plus granular custom roles and permissions
• Cross-tenant reference validation for typed and generic entity links
• Hash-chained, append-only audit events with per-organization sequence locks
• Immutable locked evidence, approved standard content, and verified benefit values
• Content hashes for attachments and evidence objects
• Approval workflows for controlled standards, case closure, and financial benefit
• Security headers, restrictive content policy, webhook signature verification, rate limits, and idempotency controls

Not yet represented as certification

RigorFrame does not claim SOC 2 certification, regulatory validation, penetration-test attestation, or legal compliance merely because controls exist in code. Those require operating evidence, independent review, and—where applicable—customer-specific validation.

Security contact

Report suspected vulnerabilities to security@rigorframe.com. The incident-response procedure and disclosure expectations are included in the release documentation.