Row-level security
HELAÜLOOM keeps every account’s data apart at two layers. The application scopes every read and write to the signed-in account, and since 3 October 2026 the database enforces the same rule underneath it.
PostgreSQL row-level security is switched on and forced for the 50 tables that hold personal and vault data, including the vault and its entries, nominees, legal documents, biography, time capsules, settings, audit logs and support chat. A database query that does not carry the signed-in account, set as app.current_user_id for its transaction, sees none of those rows and can change none of them. A query that forgets whose data it is working on gets nothing back, rather than everyone’s.
Scheduled jobs, such as unlock timers and capsule delivery, run under a separate system context that the policies grant only where a job needs it. Our build fails if new code queries these tables without a context.
Policies are defined in prisma/postgres/rls-policies.sql and rls-policies-user-owned.sql, enforced by rls-force.sql, and applied via scripts/apply-rls.sh after migrate deploy.