DATABASE RLS
Multi-tenant isolation at row level
Enforced at Postgres query execution, not in app logic. Workspace A cannot query Workspace B even if application code had a flaw.
SECURITY AND TRUST
Your workspace is yours, and yours alone
Every business's brand, products, and media live behind a tenant boundary enforced at the database. Nothing leaves the workspace and nothing goes live without a person deciding it should.
DATABASE RLS ENFORCEMENT. OAUTH BOUNDARIES. ZERO SHARED PROMPTS.
01Tenant RLS
02OAuth boundary
03Approval gate
POSTPROXY GATEWAY
Official OAuth, zero stored passwords
All social and channel credentials live isolated behind an audited gateway. Publishing runs on lease-based retrying queues.
HUMAN GATES
Server-enforced publishing approvals
AI Studio drafts, plans, and proposes. No content publishes without explicit human review and approval in your session.
Architecture & Trust Controls
Defensible isolation at every layer
Built from day one with the assumption that your brand IP and social credentials must be strictly isolated, verifiable, and revocable at any moment.
Control 01/
Every workspace is its own tenant
OREoS is multi-tenant, and the boundary between workspaces is enforced at the database, not just in application code. Every table that holds business data carries row-level security policies keyed to the workspace, so a query from one workspace's session cannot return another workspace's rows, even if the application code above it had a bug.
Row-level security on every table that holds brand, product, media, or post data
One user can hold several workspaces and switch between them; each workspace is billed and isolated separately
Writes from the AI pipeline go through security-definer RPCs on the caller's own session, so the RLS boundary stays the enforcement point, not a convention the code has to remember
Control 02/
Your social accounts connect through official OAuth
OREoS never asks for a social platform password. Connecting a channel goes through PostProxy, a dedicated gateway that holds the OAuth relationship and the provider-specific publishing logic behind one boundary, isolated from the rest of the codebase.
OAuth only, through each platform's own consent screen
No social account credentials are ever stored by OREoS
Publishing runs through a lease-based queue with retries, backoff, and a dead-letter path, so a failed post is retried or surfaced, never silently dropped
Control 03/
Nothing publishes without a human approving it
The AI Studio and Copilot can draft, revise, and propose. Putting anything live is a separate action. Scheduling a post is gated behind an explicit approval card in the chat: the model can propose, but only a person with the right role can approve, and the boundary is enforced server-side, not by the model choosing to ask.
schedulePost requires an explicit in-chat approval before anything is queued
The platform works without AI entirely: every AI feature enhances a manual workflow that already stands on its own
An AI failure degrades to the manual path, never to a broken screen
Control 04/
Media and documents are private by default
Uploaded media goes to workspace-scoped storage, not a shared bucket. Nothing is served from a public URL by default: the app issues short-lived signed URLs when a viewer with access actually needs one, and renditions are generated client-side rather than uploading a raw file to a third party first.
Direct browser upload to private storage
Signed URLs, time-limited, generated per request
Client-side image renditions before anything larger leaves the browser
Control 05/
Deleting an account is a real, reversible process
Requesting deletion does not erase anything instantly. It starts a 30-day soft-delete window, during which the account can still be recovered, and only after that window closes does a scheduled cleanup pass remove the data.
30-day soft delete on account deletion, recoverable within the window
Cleanup runs on a scheduled worker pass, not inline with the delete request
Workspace data stays workspace-scoped throughout, including during cleanup
Control 06/
Who else touches your data
OREoS is built on a small number of named infrastructure providers, each handling one part of the job, and nothing else. We do not sell or share workspace data, and we do not use your brand or customer data to train a model for anyone else.
Supabase: database, authentication, and storage
Vercel: the application itself, and preview deploys
Google Cloud Run: the background worker that drains queues and reconciles analytics
PostProxy: social platform OAuth and publishing
Firecrawl: website extraction during brand discovery, run only when you ask for it
Resend: transactional email
Paystack: payment processing, card and M-Pesa
Direct Contact
Found a vulnerability or have an architectural question?
OREoS is built and maintained with high accountability. Security disclosures and compliance audits go directly to engineering leadership.
Get started today
Questions before you connect your website?
Paste your website and watch OREoS build a brand profile from it, free, before you connect anything or pay for a workspace.
Setup in 2 minutes
Card or M-Pesa, in KES or USD
Full human approval on every post