Where your data sits, and who can reach it.
Ornool holds pay rates, margins and people’s CVs. We assume you will ask hard questions and we would rather answer them here.
Isolation
Row-level security is forced on every tenant-scoped table - 55 of them.
Forced, not enabled: the policy applies to the table’s owner too, so there is no role that quietly sees everything.
Four database roles, and the one that can bypass security never serves a request.
The application role, the client-portal role and the reporting role all run with row-level security applied and none is a superuser. Only the migration role can bypass it, and it runs schema changes and exits.
Your client portal runs on a separate connection, on a role that cannot read a cost rate.
A portal request is not protected by a filter in our code - it is protected by the database refusing.
Isolation is tested on every commit, by suites written to fail.
We break each protection deliberately to confirm the test notices; an isolation test that has never been seen to fail is not evidence.
Access and audit
Every change is recorded in the same transaction that makes it.
A log written afterwards is missing exactly the changes that crashed. Audit rows can be inserted and read by the application and cannot be updated or deleted - not by policy, by database privilege.
Downloading a CV is logged as it happens.
Documents are served through the application rather than by a shareable link, so “who read this candidate’s résumé, and when” has an answer, and access can be revoked.
Permissions are named, not implied.
Every action a person can take has a permission key, and roles are built from those keys rather than from job titles.
Infrastructure
Ornool runs on Microsoft Azure. The database is PostgreSQL 17 on a private network with no public endpoint - it is not reachable from the internet at all. Secrets are held in Azure Key Vault and the application authenticates to them with a managed identity, so there are no long-lived keys to leak. Sign-in is through Microsoft Entra ID.
We are not SOC 2 or ISO 27001 certified.
We are an early company and we will say so rather than imply otherwise. We can walk you through our controls, our isolation tests and our infrastructure, and we will answer a questionnaire honestly including where the answer is “not yet”.
We have not yet had an external penetration test.