Tenant isolation. Every tenant-table query flows through one
forOrg(orgId) choke — cross-account reads are structurally impossible, not just a
policy someone could forget.
Parameterized SQL only. No query is built by string interpolation.
Auto-escaping rendering. Ingested and user-entered text renders through one
escaping layer — vendor and customer text can't execute as markup on this site.
CSRF, rate limits, generic auth errors. Every state-changing request carries
a CSRF token; authentication is rate-limited; failures never reveal whether an account exists.
Strict headers and a Host allowlist. Content-Security-Policy with no inline
scripts, a Referrer-Policy, HSTS at the edge, and requests to an unrecognized Host are rejected.
Secrets stay out of the database and the logs. They live in the platform's
secret store, injected at boot.
Append-only evidence. The fetch → observation → change-record chain
is never overwritten; an undo is a new, recorded event, not a deletion.
Backups checked daily, restores rehearsed quarterly. A daily job confirms point-in-time recovery is on and a fresh snapshot exists.
Export and delete. Any account can export its full data and delete its org.
Canceling a subscription keeps read-only access for 90 days from the cancellation; after that,
access closes and the data is kept but unreachable until the account resubscribes or emails
support@rateroutine.com to delete it. Deleting an org is a separate act: access ends at once, and its data is
purged 30 days after the delete.
No rate guarantees. RateRoutine is a prompt to verify against the official
source, not a replacement for that verification — that boundary is a design choice, not a
disclaimer bolted on after the fact.