🔒 Platform & API

Row-Level Security & Hardening

Every operator's data is isolated at the database level — not just in application code.

Shipped May 7, 2026

✦ Key takeaways

  • PostgreSQL row-level security enforced on all tables — not just application middleware
  • Each operator’s data is isolated by location_id at the database level
  • Security audit covered reservations, guests, financial data, and PII tables

Multi-tenant SaaS platforms have an inherent risk: a bug in application code could accidentally expose one customer’s data to another. The standard defense is to enforce data isolation at a layer where application bugs can’t reach — the database itself.

Freebo uses Supabase PostgreSQL’s row-level security (RLS) to enforce data isolation on every table that contains operator or guest data. Even if the API layer had a bug that forgot to filter by location_id, the database would reject the query.

What RLS covers

Every table in Freebo that stores tenant data has RLS policies that enforce location_id scoping:

reservations guests products schedules assets financial records hot leads (PII)

A query from Operator A’s session physically cannot return Operator B’s rows, regardless of what the application code does.

100% Tenant-scoped tables covered by RLS policies
0 Application-layer workarounds required

What changed in the May 2026 hardening

The security hardening release audited all tables against the RLS checklist. Seven tables — including the hot-leads PII table — were identified as missing or incomplete policies and brought into compliance. The release also tightened API middleware checks and added automated tests that fail if a new table is added without RLS policies.

Does RLS affect API performance?
RLS adds a small overhead per query — typically microseconds — which is negligible compared to network and application processing time. Freebo's database schema is indexed to minimize this impact.
How does Freebo handle new tables added in future releases?
A test suite checks RLS coverage on every table in the schema. New migrations that add tables without RLS policies will fail the CI check before reaching production.

Shipped in Security hardening · May 2026