Security
This page describes Earthlyn IQ's current technical architecture — no claims beyond what's deployed.
Every organization's data is isolated in a shared database using PostgreSQL Row Level Security — enforced at the database layer, not only in application code.
Every table is scoped to your organization by RLS policy, so one tenant's data is never visible to another, regardless of application-layer bugs.
Email and password authentication via Supabase Auth, with secure password requirements and email-confirmation flows. Single sign-on (SAML/OAuth) is not currently supported.
Membership roles (owner, administrator, sustainability manager, contributor, reviewer, viewer) gate what each person can view, edit, submit and approve.
Uploaded evidence is stored in a private bucket and only ever served through short-lived signed URLs — never a public link.
Submitted data moves through structured approval workflows before it's treated as final.
Evidence links are scoped to the records and organizations they belong to, governed by the same role-based permissions as the rest of the workspace.
Significant actions — record creation, submission, approval, calculation, locking — are written to an append-only audit log with the acting user and timestamp.