Rulewisp / security
Trust should be legible, too.
A concise view of the controls and boundaries behind the Rulewisp workspace.
Security is part of the workflow: know what enters the record, who can act on it, and where the system draws its lines.
Ask a security question- Authenticated workspace
- Server-side route checks
- HTTPS/TLS deployment
Trust principles
Clear boundaries. Useful records.
The practical details matter more than a long list of promises. These are the boundaries the current product and deployment substantiate.
Data handling
Know what enters the workspace.
Rulewisp keeps the context needed to turn policy and compliance work into a clear, reviewable record.
- A workspace can contain organization profile details, privacy changes, policy metadata and status, tags, review dates, compliance tasks, mappings, audit activity, evidence metadata, and extracted text when available.
- The current deployment treats Rulewisp as one organization workspace. Policy and evidence data paths are protected by server-side administrator checks, while the organization profile, audit events, and mapping links use the default workspace scope; it is not a configurable multi-organization model.
- Policy originals are uploaded to the configured file store. Policy uploads support PDF, DOCX, PPTX, XLSX, TXT, and CSV files up to 50 MB; evidence uploads support PDF and TXT files up to 50 MB. Rulewisp attempts extraction for supported text and PDF inputs, records the extraction status or error, and stores extracted text when successful. Editing policy metadata does not change the uploaded file or extracted text.
Access controls
Signed-in access has a clear boundary.
The dashboard shell protects the workspace first, then the server checks authorization again where protected data and mutations actually happen.
- Every /app/** route sits behind the signed-in dashboard shell. When there is no session, the shell redirects the visitor to /login.
- Rulewisp currently runs as one default organization workspace. There is no configurable organization membership or tenant switching, and the default workspace scope is not a per-user organization boundary.
- Navigation visibility is only a UX layer. Admin-only API handlers call the server-side administrator guard before returning or changing protected workspace data.
Admin roles
Administrative access is intentional.
Rulewisp separates the everyday user role from the admin role so sensitive workspace operations have a named owner.
- New accounts receive the default user role. The available administrator role is the current coarse permission boundary; it is not a separate login or a granular permission matrix.
- An admin can use the workspace profile, policy library, evidence vault, compliance mappings, compliance tasks, alert inbox, and activity/audit operations.
- Those admin areas are reflected in the dashboard navigation, while the matching profile, policies, evidence, mappings, tasks, alerts, and activity API handlers enforce the admin role server-side.
Future boundaries
Know what is not shipped yet.
The current boundary is deliberately narrower than a full multi-tenant permissions system. These are roadmap areas, not capabilities to assume today.
- Configurable organizations, organization membership, and invitations are not currently available.
- Tenant isolation and switching between multiple organizations are not currently available; the product remains scoped to its single default workspace.
- More granular roles and permissions are not currently available. The shipped model is the default user role plus the admin role described above.
Encryption & network posture
A narrow, verifiable security baseline.
Deployed traffic is served over HTTPS/TLS, and the application carries baseline protections for browser and network responses.
- The application uses a strict content security policy with nonce-based scripts and strict-dynamic behavior.
- Security headers and a permissions policy reduce exposure to common browser-side capabilities and framing risks.
- This overview does not make claims about encryption at rest, customer-managed keys, certifications, or formal compliance attestations.
Security contact
Found a concern? Help us make it clearer.
Use this form for security questions, suspected vulnerabilities, or details that can help us investigate a risky behavior. Please avoid sharing secrets, credentials, or sensitive personal data.
Useful details to include
- The affected area, page, or workflow
- Reproduction steps or a minimal example
- The potential impact and urgency
- A safe email address for our reply
We review each submission through the same governed contact-message capture flow used for product inquiries.
Send a security note
Share enough context for a useful first review. We'll follow up using the email address you provide.
Keep reading
See the product in context.
Read the privacy-change feed, learn why Rulewisp exists, or reach out about access to the workspace.