Security & Compliance
Security Overview
Available todayUnderstand the security architecture that protects every organisation using Telblu.
Telblu uses layered security controls including authentication, role-based access control, organisation isolation, Row-Level Security (RLS), encryption and audit logging to protect organisational data throughout the platform.
Identity & Access
Authenticated identities, role-based access control and organisation-scoped permissions determine who can see and act on organisational data.
Data Protection
Organisation isolation and PostgreSQL Row-Level Security enforce access at the database layer for every read and write.
Platform Security
HTTPS/TLS protects data in transit and the managed backend encrypts data at rest.
Audit & Governance
Authentication, administration and governance events are captured in the application audit log for authorised organisation administrators.
Overview
Security in Telblu is not a single feature - it is a set of independent controls that work together on every request. Authentication proves who the user is, role-based access control resolves what the user may do, organisation isolation and PostgreSQL Row-Level Security constrain what the user may see, and the audit log records significant actions for administrator review.
This page is the entry point for the Security & Compliance section and links to the detailed pages that describe each control in depth.
Security Architecture
Every request made within Telblu passes through multiple independent security layers before organisational data is returned.
User
Authentication
Session
Role-Based Access Control
Organisation Isolation
Row-Level Security
Application Services
Managed Database
Layered Security Model
Each layer plays a distinct role. The model below summarises the responsibility of each control and how it contributes to end-to-end protection.
Authentication
Users authenticate using Email & Password or Google OAuth. Email verification and TOTP Multi-Factor Authentication are supported.
Authorisation
Role-Based Access Control determines which platform features and organisational data a user can access. Permissions are evaluated for every request.
Organisation Isolation
Every organisation operates within its own logical security boundary. Users can only access organisations where they have authorised membership.
Row-Level Security
PostgreSQL Row-Level Security policies enforce access directly at the database layer using organisation membership and assigned roles.
Encryption
Communication with the platform is protected using HTTPS/TLS. Data stored by the managed backend is encrypted at rest.
Audit Logging
Authentication, administration and governance events are recorded in the application audit log for authorised organisation administrators.
Security Request Lifecycle
The lifecycle below shows the sequence of checks a request passes through, from the moment the user's browser issues it to the moment the response is returned.
User Request
The user's browser issues an authenticated request to Telblu over HTTPS.
Authentication
The platform verifies the user's identity using the current session credentials.
Session Validation
The session is validated and confirmed active before any organisational data is loaded.
Role Evaluation
Assigned roles are loaded from user_roles to determine what the user is permitted to do.
Organisation Validation
The request is checked against the user's authorised organisation memberships.
Row-Level Security
PostgreSQL RLS policies filter every underlying query using organisation and role context.
Application Logic
Business logic executes against the data set the caller is authorised to see.
Response
Only data the user is authorised to access is returned. Significant events are recorded in the audit log.
Security Controls
The table below summarises the security controls currently implemented in the Telblu platform.
| Security Control | Status |
|---|---|
| Email & Password Authentication | Available |
| Google OAuth | Available |
| Email Verification | Available |
| TOTP Multi-Factor Authentication | Available |
| Recovery Codes | Available |
| Session Management | Available |
| Role-Based Access Control | Available |
| Organisation Isolation | Available |
| PostgreSQL Row-Level Security | Available |
| HTTPS/TLS | Available |
| Encryption at Rest | Available |
| SAML Single Sign-On | Available |
| Audit Logging | Available |
Security Principles
Telblu's security model is guided by four enterprise principles. Every implemented control maps back to one or more of these principles.
Least Privilege
Access is granted according to the user's assigned organisational role. Users receive only the permissions required for their responsibilities.
Defence in Depth
Multiple independent security layers protect organisational information. A failure in one layer does not remove the protection provided by the others.
Secure by Default
Protected resources require authentication and permission validation before access is granted. There is no anonymous access to organisational data.
Tenant Isolation
Logical organisation boundaries ensure users only access authorised organisational data. Cross-organisation access is prevented by policy at the database layer.
Current Security Capabilities
The lists below describe what is available today and what is planned for future releases.
Available Today
- Email & Password Authentication
- Google OAuth
- Email Verification
- TOTP Multi-Factor Authentication
- Recovery Codes
- Session Management
- Role-Based Access Control
- Organisation Isolation
- PostgreSQL Row-Level Security
- Audit Logging
- HTTPS/TLS
- Encryption at Rest
- SAML Single Sign-On
Planned
- Password Reset
- Microsoft OAuth
Security Relationships
The layers below depend on each other. Authentication produces the identity used by roles; roles produce the scope used by organisation isolation; organisation isolation feeds Row-Level Security; and every meaningful outcome is captured in the audit log before the executive platform delivers the response.
Authentication
Verifies user identity before any request is processed.
Roles & Permissions
Resolves what an authenticated user is allowed to do.
Organisation Isolation
Scopes every action to an authorised organisation boundary.
Row-Level Security
Enforces authorisation at the database layer on every query.
Audit Log
Captures significant events for administrator review.
Executive Platform
Delivers only the data the user is authorised to see.
Because each layer depends on the ones above it, an unauthenticated caller never reaches role evaluation, and a caller without organisation membership never reaches Row-Level Security. Every request is protected by the full stack.
Best Practices
Information
Enable MFA for privileged users
Require TOTP Multi-Factor Authentication for administrators, executives and any user with elevated organisational scope to reduce the impact of credential compromise.
Best Practice
Review user roles regularly
Recertify role assignments on a defined cadence to ensure permissions remain appropriate as responsibilities change. Remove access that is no longer required.
Note
Documentation reflects current implementation
Security features documented in this section describe the current implementation of the Telblu platform. Planned capabilities are documented separately until they are fully available.