Security & Compliance
Row-Level Security (RLS)
Available todayUnderstand how Telblu uses PostgreSQL Row-Level Security to enforce organisation boundaries and protect data at the database layer.
Every database request is evaluated against organisation membership and assigned roles before data is returned. This ensures users only access information they are authorised to view.
Organisation Isolation
Every database query is scoped to organisations where the user has authorised membership.
Database Security
Access controls are enforced inside PostgreSQL before rows are returned to the application.
Role Enforcement
Assigned organisational roles determine what actions a user may perform on protected data.
Secure Queries
Unauthorised records are filtered out automatically, independent of application logic.
What is Row-Level Security?
Row-Level Security (RLS) is a PostgreSQL feature that evaluates every database query against security policies before rows are returned.
Within Telblu, RLS ensures users only access data belonging to organisations where they have authorised membership.
RLS provides database-level protection independent of the application user interface.
Security Architecture
Every request passes through multiple security checks before database records are returned.
User Request
Authentication
Session Validation
Role Validation
Organisation Membership
PostgreSQL Row-Level Security
Authorised Data Returned
How RLS Works
Row-Level Security in Telblu operates across six stages that transform an authenticated identity into an authorised data result.
Authentication
Users must successfully authenticate before database access is possible.
Session Validation
Every request uses the authenticated user session. Unauthenticated requests cannot access protected resources.
Organisation Membership
Users are evaluated against the organisation(s) they belong to. Only authorised memberships are considered during policy evaluation.
Role Evaluation
Assigned organisational roles determine what actions a user may perform. Permissions are evaluated before data is returned.
Row-Level Security Policies
Database policies evaluate each query and automatically filter inaccessible rows. Unauthorised records are never returned.
Application Services
Business logic executes only after security policies have successfully granted access.
Request Flow
The diagram below shows the complete path from a user action to an authorised response.
User
The user initiates a request from the Telblu client.
Login
The user authenticates with email and password, Google OAuth or SAML SSO where configured.
Authenticated Session
A session is established and validated for the authenticated identity.
Organisation Validation
The platform resolves which organisations the user is authorised to access.
Role Validation
The user's assigned roles are loaded to determine permitted actions.
RLS Policy Evaluation
PostgreSQL evaluates Row-Level Security policies for the query using the user's organisation and role context.
Database Query
The database executes the query and returns only rows that satisfy the policies.
Response
The application returns the authorised response to the user.
Protection Model
Telblu uses a layered protection model. Each layer contributes a distinct security function.
| Security Layer | Purpose |
|---|---|
| Authentication | Verifies user identity |
| Session Validation | Confirms authenticated session |
| Role-Based Access Control | Determines permitted actions |
| Organisation Membership | Defines accessible organisations |
| PostgreSQL Row-Level Security | Filters accessible database records |
| Application Logic | Executes authorised business operations |
Organisation Isolation
Organisation data is logically isolated.
Users cannot access information belonging to organisations where they do not have authorised membership.
This isolation is enforced by PostgreSQL Row-Level Security policies rather than client-side filtering.
Benefits
Row-Level Security provides several enterprise benefits for protecting organisational data.
Database-Level Protection
Security is enforced before data leaves the database.
Automatic Enforcement
Every query is evaluated consistently using database policies.
Reduced Risk
Application bugs cannot bypass Row-Level Security policies.
Scalable Security
The same security model applies consistently across all organisational data.
Current Implementation
The table below lists the Row-Level Security capabilities currently implemented in Telblu.
| Capability | Status |
|---|---|
| PostgreSQL Row-Level Security | Available |
| Organisation-scoped policies | Available |
| Role-based evaluation | Available |
| Logical organisation isolation | Available |
| Authentication integration | Available |
| Session validation | Available |
Important Notes
Complementary controls
InfoPolicy evaluation
Security principleLogical isolation
Warning