Networth●Relationship Intelligence

Security posture

Your network is isolated by the database, not by application code.

Every query executes under your credentials against Postgres Row-Level Security across all 24 tables. Code bugs cannot expose another user’s contacts — the database refuses to return the rows.

01

No email stored

Fetched live, rendered, discarded. No bodies, subjects, or snippets written to disk.

02

AES-256-GCM encryption

Refresh tokens sealed at rest. Short-lived access tokens kept in memory only.

03

Read-only mail

Cannot send on your behalf. Compose links open directly in Gmail.

04

Staged permissions

Sign-in requests name and email only. Mail and calendar are separate grants.

05

Zero trackers

No advertising pixels, analytics trackers, or session replay scripts.

06

Deterministic logic

No AI models score or re-order contacts. All ranking is deterministic.

Technical specifications

Controls verifiable against the repository.

01

Database isolation

  • • RLS on all 24 tables: Postgres ownership policies on every table holding user rows.
  • • Inherited view permissions: Views and functions execute as caller, preventing policy bypass.
  • • No admin keys in web requests: Service-role key restricted strictly to the nightly cron.
  • • Storage isolation: Storage bucket policies scope resumes to account ID.
02

Data deliberately never stored

  • • Email bodies & snippets: Fetched on demand, rendered, discarded. Kept: timestamp only.
  • • Full calendar: Read live. Kept: only CRM-created events.
  • • Passwords: None. Delegated to Google OAuth.
03

Credentials & encryption

  • • AES-256-GCM: Authenticated encryption at rest for refresh tokens.
  • • In-memory access tokens: Kept in RAM only, retired prior to expiry, never logged.
  • • Zero client secrets: No provider API keys in browser bundles.
  • • Key rotation: Supported via fallback decryption key without downtime.
  • • HSTS: TLS enforced with HTTP Strict Transport Security.
04

Granular third-party access

  • • Minimal sign-in: Name and email only. No mailbox scopes requested.
  • • Mailbox read-only: Scoped per connected address. No send permissions.
  • • Separate calendar: Read and write are distinct, optional tiers.
  • • Immediate revocation: Disconnect calls Google revoke API and drops stored credentials.
05

Application hardening

  • • Nonce CSP & headers: Per-request cryptographic nonces, anti-framing, MIME nosniff.
  • • SSRF guards: Portal URLs filtered against private, loopback, and cloud metadata IPs.
  • • OAuth CSRF: Nonces in httpOnly cookies + origin validation.
  • • Zero trackers: No third-party analytics, tracking pixels, or session replays.
  • • Invariants tested: Automated CI tests assert RLS on every table before build.
06

The one cross-account exception

Nightly summary notification cron reads across accounts:

  • • Counts only: Function returns numbers, never names, emails, or messages.
  • • Restricted role: Web user sessions cannot execute the routine.
  • • Bearer token: Validated in constant time; fails closed if unset.

Controls & reporting

Full deletion: Settings → Delete account wipes database rows, files, and tokens immediately.

Vulnerability reports: Private disclosure to solomonjmoon@gmail.com.