Security & Compliance

Architecture Overview

Sevrel uses a hybrid deployment model designed for enterprise CRE organizations that handle sensitive financial and legal documents:

Data Encryption

Tenant Data Isolation

Multi-tenant isolation is enforced at every layer:

• Database: Every query is scoped by organization ID. PostgreSQL Row-Level Security (RLS) policies enforce isolation at the database level across 10 core tables — defense-in-depth that prevents cross-tenant data access even if application logic is bypassed.
• Egnyte: Each organization has its own OAuth credentials and document scope. Users can only access their organization's files.
• AI Context: AI prompts contain only the requesting user's organization documents. No cross-tenant data enters the model context window.
• Sessions: Authentication tokens are scoped to individual users within an organization.

Authentication & Access Control

• Microsoft Entra ID: All authentication is delegated to your organization's identity provider. Sevrel does not store or manage passwords.
• Invitation-only: No self-registration. Users must be invited by an organization administrator.
• RBAC: Three roles — viewer, member, admin — enforced on every API endpoint. Privileged operations require explicit admin authorization.
• Rate Limiting: Per-IP limits on authentication routes and per-user limits on AI query routes prevent abuse.
• Account Lockout: After 5 failed login attempts, accounts are locked for 15 minutes. Password complexity requirements are enforced.
• Session Management: View active sessions with IP address and device information. Revoke individual sessions or all sessions at once.

Audit Logging

An append-only audit log captures every significant action with full traceability:

Every request receives a unique correlation ID, enabling end-to-end traceability from browser to AI response and back.

Security Headers & Browser Protection

• X-Frame-Options: DENY — prevents clickjacking
• X-Content-Type-Options: nosniff — prevents MIME sniffing
• Content-Security-Policy — restricts script, style, and connection sources
• Referrer-Policy: strict-origin-when-cross-origin
• Permissions-Policy — disables camera, geolocation, payment APIs

Responsible AI Practices

Sevrel is designed with safeguards to ensure AI outputs are reliable and verifiable:

• Grounded responses: All answers are based on retrieved documents, not pre-trained knowledge. This dramatically reduces hallucination.
• Source citations: Every factual claim cites a specific source document so users can verify.
• No training on your data: Your documents and queries are not used to train or fine-tune AI models.
• Disclaimer: AI outputs are provided as decision-support tools, not legal or financial advice. Users are encouraged to verify important figures.

Compliance Roadmap

Sevrel is architected with compliance readiness in mind:

• SOC 2 Type II: Sevrel's architecture is designed for SOC 2 readiness, with audit logging, access controls, encryption, and change management processes in place. Formal certification is on the roadmap.
• Data residency: Application data is stored in managed PostgreSQL. AI inference requests go to our enterprise AI provider over TLS; customer data is not used for model training.
• Data retention: Configurable retention policies for conversations, audit logs, and cached data.