How we protect your data and decisions
AgentClear is procurement and governance software. This page describes the controls actually enabled today. Financial protection (insurance, guarantees, regulated escrow) requires a licensed third-party provider and is clearly labelled as sandbox simulation until connected.
Tenant isolation
Every organization-owned row carries an organization_id. Row-level security policies scope reads and writes to the calling user's active memberships. Cross-tenant reads by ordinary users are blocked at the database.
Append-only trust records
Clearance receipts and audit events have no client-facing UPDATE or DELETE policies. Receipts are written only through a SECURITY DEFINER function that validates the caller is a buyer of the target organization.
Tamper-evident receipts
Each clearance receipt is hashed with SHA-256 over a canonical JSON payload. The public verifier compares the shared hash against the persisted record without exposing supplier prices or RFQ contents.
Role separation
Roles live in a separate user_roles table checked through a SECURITY DEFINER function; the platform_admin role is not self-assignable from the client. Approvals can only be decided by buyer_admin or approver roles, and only while still pending.
Application controls (enabled today)
- All privileged operations run in TanStack server functions with authenticated context; the service-role key never reaches the browser.
- Onboarding runs inside a SECURITY DEFINER transaction — a signed-in user cannot self-join an existing organization.
- Awards run through a transactional, idempotent RPC that requires either a
clearedreceipt or anapprovedapproval request, and increments mandate spend atomically with daily/monthly rollover. - Quote submissions are constrained by the database to published, open RFQs owned by the caller's supplier profile, one quote per supplier per RFQ.
- Inputs are validated with Zod schemas server-side before any write.
- Password reset, email verification and secure sign-out follow Supabase auth guidance.
On the roadmap (not yet enabled)
- Application-level rate limiting on public endpoints.
- Private storage buckets and signed URLs for RFQ, quote and dispute documents.
- Signed outgoing webhooks with retry history.
- Third-party audits (SOC 2, ISO 27001) and regulator-facing certifications.
This page is app-owner editable content describing controls currently enabled in the application. It is not an independent audit or certification. Regulatory compliance (SOC 2, ISO 27001, GDPR, HIPAA) requires additional attestation not yet in place.