Security overview

Rowsh is designed for teams that share sensitive work with clients. This page summarizes how we approach security; it does not replace a completed questionnaire, architecture review, or contractual security exhibit.

Tenant isolation

Every customer environment runs with tenant-level database isolation. Your data lives in its own database, logically separated from other customers. Spaces organize teams and functions inside your environment; they do not weaken customer isolation boundaries.

Authentication & access control

Passwords are stored as salted hashes and multi-factor authentication is available for accounts. Sessions use HTTP-only cookies scoped to your environment with expiring tokens. Inside Rowsh, role-based permissions with per-space and per-project visibility limit who can see and change what, and security-relevant actions are recorded in audit logs.

Encryption and chat privacy

Traffic between your devices and the application is encrypted with modern TLS. Rowsh uses per-tenant storage boundaries by default. Chat supports application-level encrypted message storage, with administrator-controlled compliance access paths designed to be auditable and limited to approved organizational processes.

Data residency

Tenant databases are provisioned per customer environment. Residency requirements can be discussed during onboarding for self-hosted or dedicated deployments, and the selected hosting region is documented in the environment's operational runbook where applicable.

Subprocessors

Data portability

Workspace administrators can request a full export containing portable records and file metadata. Exports are generated as time-limited artifacts and are audit logged for governance review.

Payments

Subscription payments are processed by third-party payment processors through their hosted checkout pages. Your full card or account details never touch Rowsh servers.

Operations

We monitor for availability and suspicious activity, patch dependencies on a risk basis, and restrict production access to a small number of trained operators under least-privilege policies.

DPA

Customers that need a signed Data Processing Agreement can request one through the contact page while procurement terms are being reviewed.

Reporting concerns

If you believe you have found a vulnerability, please contact us or email security@rowsh.com with enough detail to reproduce the issue. We ask that you avoid public disclosure until we have had a reasonable time to respond. We aim to acknowledge credible reports within two business days and we will not pursue good-faith security research conducted within these guidelines.