A candid list of the security controls built into every SCM·Edge Suite workspace. This page is maintained by SCM·Edge Suite to answer common security and privacy questions from buyers, auditors, and IT teams. It is not a substitute for a signed compliance certificate — for procurement documents (SOC 2, ISO 27001, DPA, sub-processors), see the links below.
Every business table enforces Postgres Row-Level Security (RLS). Queries are scoped to the caller's tenant by policies that check auth.uid() and workspace membership — cross-tenant reads are impossible from the client SDK, the API, or a compromised JWT.
Six roles (owner, ops_manager, finance, sales, warehouse, viewer) gate 11+ sensitive routes (team, workspace, API keys, webhooks, factoring, escrow, payments, audit log). RequireRole component fails closed on the client; policies fail closed on the server.
All create / update / status-change / delete events on business objects are written to audit_log by database triggers with actor, tenant, before/after diff, and timestamp. Owner-only read. Available in Report Builder for exports.
8 phased migrations revoke broad SELECT on 40+ tables and re-grant only safe columns. Signing secrets, API credentials, plaintext tokens, OTP hashes, banking details, and campaign PII are unreadable via the data API — server-only via service role.
Public API uses scme_live_* / scme_test_* keys with per-key rate limits and auto-block on sustained overage. Webhooks are HMAC-signed with dual-secret rotation and a grace window. Idempotency keys prevent replay.
Per-tenant watchlist entries plus daily cron screens counterparties (customers, suppliers, factoring buyers) with block/review verdicts wired into invoicing and disbursement flows.
Owner-only /observability dashboard: 24h SLO, top error signatures, per-path p50/p95/p99 latency, recent stack traces. Errors optionally forwarded to Sentry via SENTRY_DSN.
Supabase-managed auth with password hashing, session rotation, magic-link and OAuth providers. 2FA available on request. Failed-login rate limiting. Seat capacity enforced by database trigger.
Report a vulnerability: security@scmedge.example — we acknowledge within 2 business days and coordinate disclosure.