Security

Isolation first. Evidence second. Secrets never in the browser.

Relia is designed for customer teams that cannot mix workspaces or invent facts about an account. Authentication uses an HttpOnly session cookie. Optional Supabase JWTs are verified on the API. This page does not claim SOC 2, ISO 27001, HIPAA, or GDPR certification.

Workspace tenancy

Every account, timeline event, risk, and chunk is tagged with an organization. API queries filter by the signed-in workspace. Members cannot open another org’s relationships.

Row-level security

Supabase migrations enable RLS and membership checks in Postgres, repeating the same isolation the FastAPI layer already applies.

Roles on the server

Viewers are read-only. Only owners and admins invite teammates or change billing. Agent writes require an explicit confirm step.

Privacy of customer evidence

Briefs and Ask Relia answers must cite stored records. Relia will not fabricate people, dates, or promises. Service-role, Stripe, and LLM keys stay off the client.

Start workspace Sign in