How RaqibCTI keeps your data private — and how we prove it.
Every control below is built into the platform today, not a roadmap slide. Where something isn’t built yet, we say so instead of implying it.
Isolated by design
Your requirements, RFIs, stakeholders, alerts, and threat profile live in a shared Postgres database — but they’re isolated by row-level security tied to your account. A database-level owner check (every private row carries your user id), not application code, decides which rows a query can even see, so a bug in a page can’t leak another user’s data.
Writes are stamped, not trusted
Every write to your private data stamps your user id — read from your signed-in session, never from the request body — onto the record, and the row-level policy re-checks it on every insert, update, and delete. A request trying to write as someone else matches zero rows; it doesn’t get a chance to succeed.
Verified, not just asserted
Isolation isn’t a design doc we hope stays true. A two-user isolation test runs against a throwaway copy of the live schema on every pull request — proving one user can’t read or write another’s rows — and a separate source-code scan flags any private-data write that isn’t scoped to the signed-in user. Both run automatically on every change.
Access & accountability
There are no organizations, tenants, or shared roles — every private row is owned by your account alone. When our own staff needs to view your data to help with support, that access is read-only by default; the narrow exception that lets staff act on your behalf is logged with who, when, and what changed.
Data handling, plainly
RaqibCTI runs on Supabase (Postgres) and Vercel. Sign-in is email and password via Supabase Auth. Traffic between your browser and the platform, and between the platform and its database, is encrypted in transit (HTTPS/TLS) by default on both providers. SSO/SAML and formal data-residency commitments aren’t built — we won’t claim what isn’t there.
Intelligence you can verify
Ask AI answers only from retrieved, cited sources — it doesn’t invent CVEs or actors, and out-of-range citations are stripped rather than shown. Sources carry a reliability tag, and a hunt hypothesis is presented as a lead, not a fact, so your analysts can weigh confidence the way a CTI team actually should.
Have a specific security question you need answered? Get in touch →