Security

What follows describes how Rivalr is actually built today. It deliberately claims no certification we do not hold.

Workspace isolation

Every row of customer data carries a workspace identifier, and every query is filtered by it on the server. The browser never chooses which workspace it is reading; it asks a gateway that resolves the caller's workspace from their session and applies the filter itself. Row-level security is enabled in the database as a second line.

How the front end talks to data

The application has no direct database access. All reads and writes go through a server-side gateway that validates the table, the filters and the action against an allow-list, caps request size, rate-limits by address, and writes an audit record for every change.

Authentication

Email and password or Google sign-in. Sessions expire after 30 minutes of inactivity. Roles are resolved server-side from your profile, never from anything the browser supplies.

What we collect about competitors

Public sources only. Nothing from behind a login, and nothing bought from a data broker. Every finding keeps a link to where it came from.

In transit and at rest

All traffic is served over TLS. A strict content security policy restricts what the application may load, and fonts are self-hosted so no third party sees your visits.

What we do not claim

Rivalr does not currently hold SOC 2, ISO 27001 or any equivalent certification. If that matters for your procurement, write to hello@rivalr.se and we will tell you exactly where we stand rather than imply otherwise.

Reporting a vulnerability

Email hello@rivalr.se. We will acknowledge within two working days and keep you updated until it is resolved.