Security & Data Handling
AquaOps stores chemical readings, maintenance history, and regulatory compliance records — data your facility may need to produce during an audit or investigation years later. Here's how we protect it.
Per-organization data isolation
Every table is scoped to your organization and enforced with Postgres Row-Level Security — not just application-layer checks. A query that isn't scoped to your org, location, and permissions returns nothing, at the database level, regardless of what the application code does.
Authentication and access
Sign-in and session management run through Clerk, with per-user granular permissions (view/create/edit/manage, broken out by module) and per-location access grants — so a front-line operator and an org admin see very different slices of the same organization.
Compliance data is never silently altered or deleted
Closure incidents, corrective actions, and their comment threads are append-only and audited. Edits to compliance-relevant records are logged with a full before/after diff, and orphaned or superseded rows are left in place rather than deleted — your regulatory history stays reconstructable.
Infrastructure
Hosted on Vercel with data in Supabase Postgres. All traffic is encrypted in transit (HTTPS). Service-role database access is limited to a small set of server-only administrative operations, never exposed to the browser.
Have a security question or found an issue?
Reach out and we'll get back to you directly.