Tenant isolation at the database

Every customer’s data is fenced off from every other customer’s using PostgreSQL row-level security — enforced at the database, not just in application code. Each business record carries an owning organisation, and the database itself refuses to return rows that don’t belong to you. The design principle is blunt: if a query ever forgets to scope itself, it returns zero rows — never someone else’s data. We test this with hostile cross-tenant access on every release, and a failing test blocks the release.

Encryption in transit & access control

All traffic between you and Roova is encrypted in transit (TLS). At rest, your data lives in an access-restricted Australian database that the application reaches only through a least-privilege, non-owner role with row-level security — so it cannot read or alter another customer’s data. Full-disk encryption at rest is on our security-hardening roadmap.

Mandatory multi-factor authentication

MFA isn’t optional. After you sign up, you set up app-based authentication (TOTP) before you can use Roova, and every login is then password + code. A stolen password alone is not enough to reach your portfolio.

Read-only banking, no payment capability

Today you bring banking data in by file import (CSV/OFX). When direct bank feeds launch, bank and loan data will be accessed read-only through Australia’s Consumer Data Right via an accredited intermediary. Either way, we never receive your banking login, and Roova has no ability to move money — no payments, no transfers, no trading. There is simply no code path that can spend your money, because the capability doesn’t exist.

Immutable audit log

Security-relevant and financial events — including any access by Roova staff and any “view as” / impersonation — are written to an append-only audit log. Entries can be added but not quietly altered or deleted, so there’s a faithful, tamper-resistant record of who did what, and when.

Who can access your data

Only three groups can ever see your data, and that’s it:

You — the account owner.
The team you invite into your organisation, at the access level you give them.
Authorised Roova staff, for support and operations only — to help you, fix a problem you’ve reported, or keep the service running. This can include a “view as” / impersonation capability so a support administrator can see exactly what you see. Every such access is restricted to authorised personnel and recorded to the immutable audit log above.

No other customer can ever see your data — that’s guaranteed at the database by the tenant isolation described at the top of this page.

We never sell or share your data

We never sell, rent or trade your data, and we never use it for third-party advertising. The only times we share it are with the sub-processors we need to run the service (for example, our Australian-region hosting, email delivery, and — if you connect banking — an accredited CDR intermediary), each bound by confidentiality and data-protection obligations, and where we are legally compelled to (a subpoena, court order, warrant, or binding legal or regulatory requirement). The full detail is in our Privacy Policy.

Australian data residency

Your data is hosted and stored in Australia, and our handling is aligned with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. See our Privacy Policy for the detail.

Daily backups

We take regular backups so your portfolio can be recovered if something goes wrong. Backups are protected to the same standard as the live data.

Reporting a security concern

If you believe you’ve found a security issue, please tell us — email [email protected] with “Security” in the subject line and we’ll prioritise it. We’re grateful for responsible disclosure.

Last updated 27 June 2026.