Security
How your family's records are kept, and what has not been built yet.
Last updated 16 September 2026.
Two guards, not one
Every table carries the family it belongs to, and Postgres Row Level Security refuses a row from any other family, using the family identifier inside your signed session.
On top of that, every server action checks your membership of the family again before it reads or writes anything. Either guard on its own would be enough. Both have to fail for one family to see another.
Documents
Uploads go into a private bucket. There is no public object, anywhere, ever.
A document is opened through a signed link good for sixty seconds, made fresh each time you ask for it.
Nothing opens one but you. No code and no model reads an uploaded file, except a passport's, once, as it is added — see Passports, so there is nothing else to take off one and nothing to get wrong.
Passports
A passport can carry a photo or a PDF. Suresby reads it once, when you add it, to fill in the name, the passport number, the nationality, the date of birth and the expiry, for you to check before you save. After that nothing reads the file; it is stored so you can open it.
Nothing that moves money
There is no column anywhere in Suresby for an account number or a policy number, and the RLS acceptance test fails if one appears. A passport number is stored, because a passport is what the record is; it is visible to the two adults in your household and to nobody else.
Nothing recorded here can be used to take money out of an account.
What the assistant refuses
It answers from your records and says plainly when something is not recorded, rather than filling the gap with a guess.
It does not give medical, legal or financial advice.
It has no way to write. Its tools read the records you typed and return them; there is no tool that changes anything and none that opens a file.
What is not built yet
A penetration test has to happen before launch, scoped to sign-in, row level security, storage links and prompt injection.
Rate limits on upload and on the assistant are written down for launch and are not in yet.
There is no client-side encryption. Suresby can read your records, and this is the honest thing to say about it.