RLS policy on every row
Tenant context is set via a session variable at the start of every connection. No app code can bypass it. Enterprise tier: separate Supabase project per tenant for maximum isolation.
Security
Built for organisations that ask hard questions
Hall's security model isn't a compliance checkbox. It's the architecture. Every tenant isolated, every action audit-logged, every connection encrypted, every secret stored separately.
Isolation
Every tenant, walled off at the database
Hall uses Row-Level Security (RLS) enforced at the Postgres level on every table. Application-layer filtering is supplementary, never primary. A cross-tenant query returns zero rows, not because of a missed WHERE clause, but because the database refuses.
EU data residency
Frankfurt primary region. Backup replicas in the same region. No US or UK data paths, full Schrems II alignment via architecture, not contract.
Hash-chained audit trail
Every compliance-relevant action is written to a SHA-256 hash chain. Any tampering breaks a downstream row. Administrators can trigger full-chain verification any time.
Encryption
At rest, in transit, in the right places
Not all data is equal. Hall encrypts every sensitive field with AES-256-GCM individually, not just the database volume. The plaintext is never stored in any column, log, or URL.
SSO client secrets
OrgSsoConfig.clientSecretEnc holds your IdP secret wrapped in AES-256-GCM with a per-deployment ENCRYPTION_KEY. Decrypted only when initiating an SSO handshake.
Phone numbers (SMS)
AES-256 encrypted with separate IV and auth tag. A one-way hash allows verification without decryption. Delivery logs never include the plaintext number.
TLS 1.3 end-to-end
Let's Encrypt certificates on custom domains, auto-renewed. HSTS enforced; no HTTP fallback anywhere.
Access
Who can see what
SSO with Entra + Google + Okta
OIDC + PKCE for every provider. Per-tenant config, per-tenant issuer, per-tenant claim mappings. SAML 2.0 available on Enterprise.
Role-based access
Six distinct roles (ORG_ADMIN, COORDINATOR, MANAGER, DEPT_MANAGER, LEARNER, INTERNAL_TRAINER). Permissions defined in code, enforced on every API route.
Session + seat gating
Session JWT encrypted, 30-day lifetime. Seat caps enforced at creation time, not at login, a full plan won't silently let users past the limit.
Transparency
Third-party processors, disclosed
Hall uses third-party services under strict DPAs. Every one is documented in your tenant's Privacy Notice, auto-generated from your active integrations so it stays accurate without manual updates.
Anthropic (Claude API)
Anonymised payloads only. No names, emails, or employee IDs. Role hashes and score ranges. EU region.
Supabase (Frankfurt)
Managed Postgres, storage, pgvector. EU region mandatory in our config.
Resend (email)
Transactional email, EU region. Custom sender domain per tenant for branding + deliverability.
CM.com (SMS)
Netherlands-based, EU data residency. Encrypted phone numbers pass through; plaintext never leaves Hall's memory.
Cloudflare R2 (video)
EU region bucket. Zero egress fees. Signed URLs for access control.
Full DPA list
Every processor has a signed Data Processing Agreement. Shared on request with your compliance team.
Incidents
When something goes wrong
No software is incident-free. Hall is built to minimise blast radius, detect early, and respond fast. Sentry tracks every error; PII is stripped in the beforeSend hook. Tenant context is attached for debugging but never leaves our logging stack.
72-hour breach notification
Your DPO is notified within 72 hours of any confirmed breach affecting your tenant's data. Via email + in-app banner.
Status page + uptime
status.colport.io (coming with Sprint 48) publishes incidents in real-time. Subscribe to get SMS alerts on major outages.
Security team needs a deep dive?
Happy to run a session with your CISO or Data Protection Officer. Includes a tour of the audit trail, RLS policies, and DPA package.
Request a demo