How Orbrik
protects your data.

WhatsApp · LINE · Voice notes · Meetings · In-app capture. No email ingest. No Slack. No Notion. No calendar sync. What isn't listed doesn't exist.

Each channel requires explicit opt-in verification. Unknown senders are rejected at the gateway before any data is written.

Captures that cannot be confidently attributed are held in the Needs You queue for founder review. Nothing enters the system without a verified origin.

Row-Level Security enforced on the organisations table. Policy: membership-join OR current-org OR owner-account. Fail-closed when the session GUC is unset. Migration 0029.

Account-keyed RLS on the org_memberships table. An authenticated account can only read its own membership rows. Migration 0031.

Only the background worker (orbrik_worker) runs with BYPASSRLS — for scheduled jobs that must read across orgs. Every human API path is RLS-enforced with no exceptions.

Path org_id is compared to the authenticated request context at every endpoint. A member of Org A cannot read Org B's data — even with a valid JWT and a known UUID.

All business data stored in a single PostgreSQL instance with the pgvector extension for semantic search embeddings. No data leaves the primary store during normal operation.

File attachments use R2/S3 via boto3 with explicit timeouts: 5s connect · 30s read · adaptive retry 3×. No silent hangs.

pg_dump -Fc runs on a systemd timer. Each backup is uploaded to R2 and old copies are pruned on a rolling schedule.

The restore procedure runs against a throwaway pgvector/pg16 environment. Last verified: 1,238 organisations restored clean.

Validates the JWT and checks account suspension. A suspended account is denied before any org check runs — independently of org state.

Validates org membership and checks org suspension. A suspended org is denied regardless of account status.

Account suspension and org suspension are architecturally independent. Neither unsuspends the other. Both gates must pass for any request to proceed.

Platform operations pass a third gate with no cross-escalation. Super-admin access cannot be derived from founder or org-owner status.

The audit table has no UPDATE path and no DELETE path. The writer role (orbrik_worker) holds SELECT + INSERT only. Schema-level tamper resistance.

The audit row and the state change commit in the same database transaction. A mutation with no audit entry cannot exist.

actor_account_id is NULLABLE ON DELETE SET NULL. If an actor's account is later deleted, the audit row survives intact — the record outlives the actor.

No agent output is applied to your business without explicit founder approval. This is not configurable — there is no auto-apply path in the codebase.

Every agent draft routes to the Needs You queue. Two exits: Approved or Rejected. The agent waits. Nothing proceeds until you decide.

Account and organisation suspension are independently enforceable and reversible by the platform operator. Every change is logged to the audit trail.

Founders retain read access to their own account state at all times. No background process modifies your data without an audited, approved trigger.