Glossary
What is row-level security?
What row-level security means, why it matters when many businesses share one cloud system, and what it looks like on a real query.
Updated
In short
Row-level security is a database rule that decides, row by row, which user or business may see or change data. SimpleERP isolates every business's records with PostgreSQL row-level security, enforced by the database on every query.
Row-level security is a database feature that decides, for every row of every table, which user or tenant may see or change it. In business software that serves many companies, it means one company's data cannot be read by another even if application code has a bug, because the database itself enforces the boundary on every query.
Row-level security (RLS): a worked example
Lakshmi Steel Furnitures and another business both keep their invoices in the same cloud database table. A user signed in to Lakshmi Steel asks for every invoice above ₹50,000.
| Invoice | Business | Total | Returned to the Lakshmi Steel user |
|---|---|---|---|
| INV-2026-27-0012 | Lakshmi Steel Furnitures | ₹1,00,300 | Yes |
| INV-2026-27-0013 | Lakshmi Steel Furnitures | ₹59,000 | Yes |
| INV-2026-27-0041 | Another business | ₹2,36,000 | No, filtered by the database |
How does row-level security work on a query?
Each table carries a business id on every row and a policy that says, in effect, show and accept only rows whose business id equals the session's. When the Lakshmi Steel user runs the query above, the database quietly adds that condition. The other business's ₹2,36,000 invoice is never read, so no screen, report or CSV export can show it.
What does row-level security not protect against?
It separates businesses, not people inside one business. Whether Lakshmi Steel's store keeper may see payroll is decided by roles and permissions. It also does not replace a strong password, and someone signed in as the owner sees everything the owner sees.
FAQ
Questions, answered
What does RLS stand for?
RLS stands for row-level security. It is a feature of databases such as PostgreSQL that attaches a policy to a table, and the database applies that policy to every select, insert, update and delete on it, whichever screen or report sent the query.
Why does row-level security matter in cloud software?
Cloud software usually keeps many businesses in one database. With row-level security the boundary between them is checked by the database itself, so a missed filter in one screen or one new report cannot expose another business's invoices, payroll or customer list.
Is row-level security the same as user permissions?
Row-level security is not the same as user permissions. Permissions decide what a person may do, such as post an invoice or view payroll. Row-level security decides which business's rows any query can reach at all. A secure system uses both layers.
Does row-level security slow the software down?
Row-level security adds one condition on an indexed business id to each query, checked inside the database with the query itself. For a small business with thousands of invoices rather than millions, the extra time is too small to notice on any screen.
Related
Keep reading
ERP
Enterprise resource planning: one system for sales, stock, purchases, accounts and payroll, where every entry is made once.
Read moreLock date
The date on or before which the books cannot change.
Read moreSecurity
How SimpleERP protects your data today: row-level security, scrypt passwords, revocable sessions, audit history and CSV export.
Read more
Run your whole business from one simple place.
Seven days free. No card. Your first GST invoice in minutes.