Security
Provenance is designed so that the owner organization remains in control of its lease record. Security is built into the data model, not added on top.
Authentication
Provenance uses industry-standard authentication with email and password or Google OAuth. Sessions are managed with secure tokens and automatic expiration.
Role-based access control
Every workspace has owners, admins, and members. Members can be scoped to specific properties, and access is enforced at the database level by Row Level Security policies.
Row Level Security
Database queries are filtered by organization membership. A user can only read or modify data that belongs to organizations they are a member of.
Audit logging
Key actions — fact verification, amendments, invites, role changes — are written to an append-only audit log with the actor, timestamp, and before/after values.
Encrypted storage
Documents and data are stored with encryption in transit and at rest by the underlying cloud infrastructure provider.
Private document storage
Uploaded lease documents are stored in a private bucket and are never publicly accessible. Access is verified on every request.
Reporting a security issue
If you discover a security vulnerability, please report it to security@provenance.holdings. We take reports seriously and will respond promptly.