RGU Security Center
Production security posture — configuration-derived. No secrets, credentials, or sensitive documents are displayed here.
76
76
Entities with RLS
0
0
Failed auth attempts (recent)
0
0
Registered processors
0
0
Open data-subject requests
RLS Status
76 entities enforce server-side least-privilege RLS with data.-prefixed custom fields. A snapshot of secured entities:
TenantProfile
LandlordProfile
PropertyManagerProfile
Property
Unit
PortfolioAccess
TRSScore
AuditLog
TPLSettings
TPLBadge
TPLEvent
NeighborhoodProfile
SimulationRun
RentPayment
PaymentTransaction
PaymentMethod
RecurringPayment
CreditReporting
Lease
RentalApplication
VerificationRequest
MaintenanceRequest
Inspection
Notification
TenantMember
LandlordMember
Lead
Contact
Account
AgentLead
Task
Activity
Message
Document
TenantFeedback
TPLReview
TenantBlacklist
Base44Purchase
BlogPost
Agent
+36 more
Storage Findings
| Caller | Type | Storage |
|---|---|---|
| AIDocumentExtractor | ID / paystubs | Private |
| BlacklistSubmissionForm | Legal evidence | Private |
| MaintenanceRequestForm | In-unit photos | Private |
| RentalApplicationForm | Pay stubs / ID | Private |
| DocumentManagement | Leases / insurance | Private |
| DocumentReviewer | Lease / screening report | Private |
| Blog / PropertyMarketing imagery | Marketing assets | Public (intentional) |
Security Audit Events (recent)
No audit events recorded yet.
Processor Inventory
| Processor | DPA |
|---|
Retention Policy Status
No retention policies configured. All proposed periods require legal approval (design only — no deletion jobs active).
Active legal holds: 0
Outstanding Security Findings
- Complete DPA execution for all 10 processors (currently all 'not_executed')
- Verify private-file storage encryption specifics with Base44 (not documented)
- Confirm cross-account RLS enforcement via impersonation testing (not verifiable from tooling)
- Complete per-caller AI prompt audit for all remaining chatbot/analyzer components
- Extend audit logging to tenant-profile/TRS/application-status frontend read flows
- Obtain legal approval for proposed retention periods before any enforcement
- Verify Google Ads non-reversible identifier is acceptable under applicable privacy law