Security
Security position, stated with its evidence
No certifications, audits or SLAs
Toros Ricos OÜ holds no security certification for Bobby DB, has commissioned no penetration test, publishes no audit report and offers no uptime or support commitment. Any such claim found elsewhere would be untrue.
Security principles
The properties the implementation is required to satisfy, and which the governed pilot already enforces.
- Authentication is never authorization
- Signing in with email and password proves who you are and grants no Bobby DB account, role, workspace access or authority. Admission is granted by the operator, and every read and write is decided server-side against stored role assignments.
- Workspace is the isolation boundary
- Every collection, group, entry, release and key belongs to exactly one workspace. Authorization resolves the caller's workspace first, so a query cannot accidentally span tenants.
- Row-level authorization, not application filtering
- Access rules live in the database as row-level security policies rather than in application query builders, so a forgotten filter in application code cannot expose another tenant's rows.
- Keys are hashed, shown once
- An API key is stored only as a hash. The plaintext is displayed once at creation and never again, so a database read cannot recover usable credentials.
- Keys never travel in a URL
- Keys are accepted only in a request header. URLs leak into server logs, proxy logs, referrer headers and browser history; headers do not.
- Least-privilege scopes
- A key carries read scope or write scope for one workspace. A public read client never needs a write-capable credential.
- Encryption in transit
- All traffic is served over HTTPS. Plain HTTP is intended to redirect rather than serve.
- Human review before publication
- A release is created by an explicit human review step, so bad automated input cannot silently become the data every consuming application reads.
- Immutability as a safety property
- Because a published release cannot be edited, a compromised or mistaken write cannot rewrite history that consumers already pinned.
- No secrets in values
- Bobby DB is not a secrets manager. Customers are instructed not to store credentials, tokens or payment card data in entry values, and the product is not designed to protect them.
Control status today
Every row states what is true now, not what is intended. “Implemented — pilot” means built and reachable by authorized pilot operators; “Planned” means designed but absent; “Not available” means it cannot be claimed at all.
| Control | Status | Evidence |
|---|---|---|
| HTTPS-only public website | Implemented | Served over HTTPS by the hosting platform today. |
| Email and password sign-in, no public registration | Implemented — pilot | Sign-in exists on the identity page. Public registration is disabled and enforced server-side. |
| Authentication separated from authorization | Implemented — pilot | Signing in creates no account, role or access. Admission is granted by the operator and enforced server-side. |
| No analytics, advertising or tracking cookies | Implemented | The site sets none, so there is no third-party tracking surface. |
| Governed schema with no customer data | Implemented — pilot | The governed schema, policies and grants exist. Production holds one operator account and zero workspaces, collections, entries, releases and API keys. |
| Row-level security policies | Implemented — pilot | Policies and grants are applied per table and exercised by an executable database verification harness. |
| Hashed API keys with one-time display | Implemented — pilot | Keys are hashed at rest, shown once at creation, scoped to one workspace and revocable. None has been issued in production. |
| Rate limiting and usage accounting | Implemented — pilot | Enforced per key at the REST delivery boundary. The MCP interface is deferred and answers no request. |
| Audit trail of reviews and releases | Implemented — pilot | Append-only and hash-chained per environment, with a verification function. |
| Billing and payment handling | Not available | No billing exists, so no payment or card data is processed. |
| Penetration test | Not available | None has been carried out. No report exists. |
| SOC 2, ISO 27001 or similar certification | Not available | None held, none in progress, and none claimed. |
| Uptime SLA or availability commitment | Not available | None offered. No uptime figure is published because none has been measured. |
| Published sub-processor list and transfer safeguards | Not available | Final production configuration is not fixed, so a truthful list cannot be published. |
What this means for you
No customer content is held
There is no public registration, and no customer has been admitted, so Bobby DB holds no customer collections, entries, releases or API keys. The only account is the operator's own.
Evaluate the controls, not a promise
The isolation and key-handling controls above are implemented for the pilot and are what to scrutinise now. No independent test or certification backs them, so ask for evidence before relying on any of them.
Reporting a problem
No security contact address or disclosure programme is published yet. Publishing one before it is monitored would be worse than publishing none.
This page is revised as controls change. A control moves from Planned to Implemented only when it can be demonstrated, not when it has been designed, and no control is described as independently tested or certified.