DRAFT — Not a compliance certification or vendor assurance letter. Founder and legal counsel must review before public launch or customer contract reliance. HAZON does not claim SOC 2, ISO, PCI (beyond Stripe's role), GDPR certification, uptime SLAs, or third-party SIEM integrations on this page.

Security

Security overview

Last updated: 20 July 2026 (draft)

HAZON is multi-tenant event and visitor operations software. The notes below describe controls that exist in the product today. They are not guarantees of absolute isolation, regulatory certification, or contractual service levels.

Tenant isolation (Postgres RLS)

Organization-scoped tables use Supabase Postgres Row Level Security (RLS) policies and helper functions (for example is_org_member / can_manage_org) so authenticated members generally only see rows for organizations they belong to. Misconfiguration, privileged service-role paths, or application bugs can still create risk — RLS is a core control, not a claim of zero cross-tenant leakage.

Retention and scrub jobs

When retention settings and the scheduled GDPR scrub cron are enabled and running, eligible visitor or related records can be anonymized or purged according to those settings. Scrub is operational and configurable — this page does not assert GDPR "by design" compliance or certified privacy frameworks. See the draft Privacy Policy.

MFA settings

Organizations can configure MFA policy (including mandatory TOTP and admin enforcement) via security settings. Fresh organizations may default to mandatory TOTP depending on migration defaults. MFA reduces account takeover risk when enrolled and enforced; it is not a substitute for strong operational security.

Encryption and hosting

Traffic is expected to use TLS in production deployments. Database and object storage encryption at rest depend on the hosting provider (for example Supabase/Postgres and the deployment platform). HAZON does not publish a separate uptime SLA or multi-region RPO/RTO commitment on this draft page.

Illustrative RLS policy shape

Example pattern used in the codebase (simplified). Actual policies vary by table and are maintained in migrations and policy SQL.

ALTER TABLE public.passes ENABLE ROW LEVEL SECURITY;

CREATE POLICY "members can view passes"
  ON public.passes
  FOR SELECT
  TO authenticated
  USING (public.is_org_member(organization_id));

What this page does not claim

No absolute isolation guarantees, no regulatory certification statements, no published numeric uptime SLA, and no third-party SIEM streaming integrations unless separately contracted and implemented. Enterprise SSO (SAML/OIDC) is not asserted here as a general-availability compliance feature.