Row-level security
Production database tables use Supabase RLS to enforce user and organization boundaries.
Trust & security
Zdravo is being built as governance infrastructure, so security cannot be a marketing layer placed around the product. The current architecture puts identity, authorization, policy evaluation, persistence, and auditability on the execution path.
Production database tables use Supabase RLS to enforce user and organization boundaries.
Governed agent decisions are tied to authenticated organization and agent identity rather than caller-supplied organization IDs.
Governed execution requires a valid invocation and policy decision. Authorization, persistence, and state-transition failures do not silently become ALLOW.
Governed observations and decisions are recorded as audit evidence and provenance metadata for later inspection.
Production persistence uses Supabase Postgres with pgvector. Security boundaries are enforced in the database as well as the application layer.
Important distinctions
Not end-to-end encryption: Zdravo's hosted service must be able to process stored context for retrieval and governed operations. Do not describe the hosted service as zero-knowledge.
Not SOC 2 certified: The product has a security architecture designed toward enterprise controls, but this page does not claim an independent SOC 2 certification.
Data region: the live value is published by the privacy API (/api/privacy-dashboard → transparency.data_residency). It reports the configured deployment region, or unknown when none is configured. Custom residency is not represented here as an already-live feature.
Security questions or vulnerability reports?
security@zdravo.ai