Security
Last updated: July 2026
Official answers to the questions RQE hears from security, IT, and procurement teams. Concise, verifiable, and updated as the posture evolves.
Quick reference
| Topic | Status | Notes |
|---|---|---|
| Data residency | Regional (EU / US) | Default matches workspace region |
| GDPR | Supported | DPA available on request |
| Encryption in transit | Yes | TLS 1.2+ |
| Encryption at rest | Yes | Infrastructure-managed keys |
| Authentication | Email/password + Google | SSO on roadmap |
| MFA | Via Google sign-in today | Native TOTP on roadmap |
| Authorization | Row-Level Security per tenant | Roles separated from profile |
| Audit logs | Yes | Retained per plan |
| API security | Bearer JWT + API key | Rate-limited per key |
| Backups | Daily, infrastructure-managed | Point-in-time recovery via Supabase |
| Availability SLA | Not formalized yet | Roadmap: 99.9% at GA |
Data residency
RQE runs on Lovable Cloud, which is backed by Supabase infrastructure. Data residency defaults to the region of the workspace. Cross-region replication is not enabled by default.
GDPR
RQE is designed to support GDPR obligations. Data subjects can request access, rectification, and erasure through the workspace admin. A Data Processing Agreement (DPA) is available on request. Sub-processors are limited to the infrastructure providers (Lovable Cloud / Supabase) and the payment processor (Paddle).
Encryption
All traffic to and from RQE is served over HTTPS with TLS 1.2 or higher. Data at rest is encrypted at the storage layer using infrastructure-managed keys. Secrets (API keys, OAuth tokens) are stored in a secrets manager separate from the application database.
Authentication
Users sign in with email and password or Google. Google sign-in inherits Google's MFA. Session tokens are short-lived and refreshed on activity. Passwords are hashed using industry-standard algorithms. Native TOTP MFA and SAML SSO are on the roadmap.
Authorization
Access is enforced at the database layer with Row-Level Security (RLS). Every tenant-scoped table has policies keyed to the caller's organization membership. A separate user_roles table (never the profile) stores role assignments, checked through a SECURITY DEFINER helper. This design prevents privilege escalation via row edits.
Audit logs
RQE records an audit log entry for material state changes: user invitations, role changes, ownership transfers, commission recalculations, and API key rotations. Log retention is set per plan. Logs are read-only from the application UI.
API security
Public API access requires a Bearer JWT (user-scoped) or an API key (machine-scoped). Every credential is scoped to a workspace and a role. Rate limits are enforced per key. Idempotency keys are honored on write endpoints. See API for the full model.
Backups
Backups are managed by the underlying infrastructure. Supabase performs daily backups with point-in-time recovery for supported plans. Customer-initiated exports are available from the workspace settings.
Availability
RQE does not yet publish a formal SLA. Target availability at GA is 99.9%. Planned maintenance windows are announced in advance to workspace admins.
Reporting a vulnerability
Please report suspected vulnerabilities to security [at] revenuequalityengine.com. Reports are acknowledged within two business days. Coordinated disclosure is expected — please do not publicly disclose before RQE has had a reasonable window to respond.