Security and data handling
RebateLedger holds rebate agreements, claim decisions and settlement records — the evidence behind money that has already moved. This page states plainly how that data is isolated, recorded and protected, and what we do not yet certify.
Tenant isolation
Every table carrying customer data has PostgreSQL row-level security enabled and forced. Reads and writes run inside a tenant context that sets the tenant identifier on the connection, and the policies filter on it. A query written without a tenant predicate returns nothing — it does not fall back to returning another tenant’s rows.
The application connects as a database role that cannot bypass row-level security, so the isolation holds even if application code is wrong. That is the point of enforcing it in the database rather than in the query layer.
A tamper-evident audit trail
Every state change is written to an append-only audit log in the same transaction as the business write. A settlement cannot be recorded without its audit entry, because both succeed or neither does.
Entries are hash-chained: each links to the one before it, so altering or removing a historical entry breaks the chain and is detectable. The chain is verified on a schedule, and the verification itself is recorded. This is what lets you answer “who changed what, and when” with evidence rather than recollection.
Personal data and the DPDP Act
Consent is captured explicitly under the Digital Personal Data Protection Act 2023: never pre-ticked, always with a link to the privacy policy at the point of collection, and always with a clear unsubscribe route. What we collect and why is set out in the privacy policy.
Hosting and deployment
The application and its PostgreSQL database run on managed cloud infrastructure. An on-premise deployment mode also exists for customers whose policy requires data to remain on their own infrastructure.
Region and provider detail for a specific contract is something we put in writing during procurement rather than publish here, because it can change and a stale page is worse than no page.
What we do not have
RebateLedger does not currently hold SOC 2 or ISO 27001 certification. The controls described above are implemented and can be walked through in a technical review, but they have not been audited against those frameworks by a third party.
We would rather state that here than let you discover it at diligence. If a certification is a hard requirement for your procurement, raise it early and we will tell you honestly whether we can meet your timeline.
Reporting a vulnerability
If you believe you have found a security issue, email support@claimds.com with enough detail to reproduce it. Please give us a reasonable window to respond before disclosing publicly. We will acknowledge your report and tell you what we are doing about it.
Frequently asked questions
Can one customer see another customer’s data?
No. Every table carrying customer data has PostgreSQL row-level security enabled and forced, and every query runs inside a tenant context that sets the tenant identifier for the connection. A query that omits the tenant predicate returns nothing rather than returning another tenant’s rows. The application connects as a role that cannot bypass those policies.
Is there an audit trail?
Yes. Every state change — accrual, claim decision, reversal, settlement — is written to an append-only log in the same database transaction as the business write, so a change cannot be recorded without its audit entry. Entries are hash-chained, which makes tampering detectable rather than merely discouraged, and the chain is verified on a schedule.
Where is our data hosted?
The application and its PostgreSQL database run on managed cloud infrastructure. An on-premise deployment mode also exists for customers whose policy requires data to stay on their own infrastructure. Ask us for the current region and provider detail for your contract — we will put it in writing rather than describe it here, because it can change.
How is personal data handled?
Consent is captured explicitly under the Digital Personal Data Protection Act 2023: no pre-ticked boxes, a link to the privacy policy at the point of collection, and a clear unsubscribe route. See the privacy policy for the full statement of what is collected and why.
Do you hold SOC 2 or ISO 27001 certification?
Not at present. We would rather say so than imply otherwise. The controls described on this page are implemented and can be demonstrated in a technical review; they have not been audited against those frameworks by a third party. If a certification is a hard requirement for your procurement, tell us early.
Who can access our data internally?
Access is limited to the people who need it to operate and support the service, through the same tenant-scoped mechanisms the application uses. Support access to a customer tenant is deliberate and recorded in the audit trail rather than ambient.