Implemented
Server-owned organization context
The signed-in membership determines the active organization on the server. A browser-supplied organization ID is never treated as authorization.
Security and trust
Controls you can understand, and limits we state plainly.
Venturoost is built around tenant isolation, server-side authorization, evidence, and explicit approval. It is still a private beta, so this page also names what has not yet been certified.
Security model
Protection is enforced below the interface.
The product does not depend on hidden buttons or client-side state to protect business data. Server-owned organization context resolves access, and Postgres row-level security reinforces that boundary in the database.
Implemented controls
Current safeguards in the product.
Implemented
Database tenant isolation
Tenant-owned Postgres tables use row-level security, explicit organization filters, and same-tenant relationship checks.
Implemented
Role-bounded changes
Owner, administrator, manager, and employee permissions are checked at the mutation boundary. Sensitive team and connector operations remain restricted.
Implemented
Evidence and audit history
Findings, proposals, approvals, work completion, and internal execution artifacts retain source references, immutable receipts, or audit events.
Implemented
Exact-case approval
High-impact actions require a fresh, single-case approval bound to the exact proposal and evidence. Standing approval is forbidden.
Implemented
External writes disabled
The current product cannot change accounting, banking, payroll, HR, device, or other external provider records.
Generated suggestions
Automation does not replace owner judgment.
Some suggestions are generated with AI. Every one links to its evidence, and nothing happens without your approval.
Current limitations
What we do not claim.
- No security certificationVenturoost does not currently claim SOC 2, ISO 27001, HIPAA, PCI DSS, or another third-party certification.
- No legal or compliance adviceThe product does not certify that a business is compliant and does not replace legal, tax, accounting, insurance, or regulatory professionals.
- Unscanned files are labeledPrivate document lifecycle controls exist, but files remain explicitly unscanned unless a private scanner is configured.
- Hosted acceptance remains openBroad invitations wait for the exact hosted candidate to pass the full authentication, isolation, browser, cleanup, worker, recovery, and observability gates.
- No external provider writesRead-only connector work cannot move money, send messages, modify payroll, or update external records.
Questions
Read the product boundaries before requesting access.
The FAQ explains data sources, integrations, pricing, support, and what the private beta can do today.