Security you can verify in the design
This page makes no claims a badge could carry. It describes how Faldaro is built — mechanisms you can check in the product's behaviour, not adjectives.
-
Tenant isolation, enforced by the database
Every tenant-scoped table carries row-level security policies in PostgreSQL, matched against the organisation bound from your verified token. The application cannot forget to filter — the database does it, and a query that loses its tenant context returns nothing rather than everything.
-
An append-only audit log
The audit table accepts inserts and refuses updates and deletes at the database-permission level. What happened is what the log says happened; there is no code path that can quietly rewrite history.
-
Versions are immutable once published
Publishing a form, dataset or template creates a new version and freezes the old one. A submission keeps the exact definition it was filled against — change your pricing tomorrow and yesterday’s records still mean what they meant.
-
The server owns every derived value
Submitted data and computed data are stored separately, and the engine recomputes on every write. A tampered request cannot fabricate a total, skip a validation or set its own payment amount — the server’s answer is the only one recorded.
-
Formulas and templates cannot run code
Form logic runs on a closed expression evaluator — a fixed set of operators and functions, no script engine. Document templates are structured data with every merged value escaped. Author-supplied patterns and templates run under hard resource budgets.
-
The public surface is opt-in and tokenised
A form is reachable anonymously only when you publish a link for it. Links carry unguessable tokens, revoke by rotation, and answer every refusal identically — a withdrawn link is indistinguishable from one that never existed. Formulas and workflow are never exposed.
Access control
Privileges flow down, never up
Roles grant privileges on an organisation and its descendants — a parent administrator can run the whole subtree, and nothing flows upward or sideways. You cannot grant a privilege you do not hold, which is what stops anyone minting a role above their own access.
Sign-in
Passkeys, Google, or email and password
Accounts support passkeys for phishing-resistant sign-in alongside Google and password authentication. Sessions are refresh-token based and organisation switches re-check membership on every reissue.
Questions about how something specific is handled? Ask us at sales@faldaro.com and we will answer in the same register as this page: with the mechanism. Running an enterprise evaluation? The Enterprise page describes the plan and the buying process.
Built so the safe thing is the default
Start on the Free plan and check every claim on this page against the product itself.
No card required.