Row Level Security (RLS)
Rules built into the database that decide, row by row, who can read or change each record.
What is Row Level Security, and how does it protect my application's data?
Row Level Security is a feature of databases like PostgreSQL that applies permissions to each individual record. The database itself checks who's making the request and only lets them see or change what they're entitled to, even if the application gets its filtering wrong.
It's especially useful in services like Supabase, where the application talks to the database using a public key. That key isn't secret by design; what actually protects the data is the set of rules.
Why it matters to your business
An application with many users, or with sensitive data, can't depend on every single screen remembering to filter information correctly. With rules built into the database, a mistake in the interface code isn't enough on its own to expose another customer's data.
How we use this at Damorus
At Atlantic Center, security comes from Row Level Security plus a dedicated sync account: public sign-up is switched off, and only an authenticated session belonging to the school can read or write. On top of that, delete permission is revoked at the database level, so the app can only mark records as deleted; an actual, permanent delete needs a master key that the owner keeps. URG Technology uses PostgreSQL with Row Level Security on its operational tables.
Need this on your project?
I want my free mockup →