Understand BuildVouch's security model

BuildVouch records evidence and release decisions. It does not provide a certification or guarantee that software is secure.

Organisation isolation

Database grants and row-level policies work together. Reads require membership in an active organisation. Editors and owners receive limited write permissions. Verified source state, approval records and audit history cannot be written directly by ordinary clients.

Evidence and audit

Evidence, release attestations, approvals, exceptions, content revisions and audit events are append-only. Database triggers enforce transitions and write audit events in the same transaction.

Privileged access

Tokens are application-scoped and stored as hashes. Upstream GitHub credentials and the Supabase service role stay server-side. The server independently verifies the actor and application before using privileged integration functions.

Recent MFA is required for token management, invitations, role changes, sensitive exports, release approval and public CMS publishing.

Source trust

GitHub integration bindings are controlled by the platform operator. Only approved repository, branch, workflow and event combinations produce verified source records. API and manual submissions remain unverified.

Deployment and operations

Before launch, verify the target database, applied migrations, authentication settings, rate limits, backup restoration, logging and production secret configuration. Passing local build checks does not prove those controls are deployed.

Data handling

Do not upload raw secrets or unnecessary personal data into security records. Source reports remain in their appropriate protected systems. Establish retention and deletion procedures before onboarding external customers.

Registration details, legal jurisdiction, privacy contacts, contracts and subprocessor commitments require verification before legal publication. This guide does not assert those unverified facts.