Your data stays yours
Tenant isolation proven by tests that run against a live database, an audit log you can export, and vendor access you grant and revoke.
Tenant isolation
Your organization is walled off at the database
Built into the tables
Every project record carries its organization, and the database refuses a row that claims a different organization from its project. Structural, not a filter someone has to remember.
Row-level security on every table
Read policies are scoped to your organization, and signed-in users have no write policies at all. Every write goes through a server route that checks who you are first.
Files behind the same rule
Project files sit in a private bucket. Storage rules let only your organization’s readers and the project’s members open them, at the database, not just by link.
Proven against a live database
Test suites seed two organizations and sign in as a real user of one. They assert it cannot read, write, download or subscribe to anything in the other, and that an anonymous client gets nothing.
No route without a check
A test fails the build if any server route uses the privileged database client without an authorisation gate in front of it.
A suspended organization is frozen
When an organization is not active, every write to its projects is refused until it is reinstated.
Support access
You grant our access, and you take it back
- Step 01
We ask, with a reason
A request names why and for how many hours. The database refuses a request with a blank reason.
support request
- Step 02
Your owner or admin decides
Only your own owner or admin can approve, decline or revoke. Nothing on our side can approve a grant.
your /org page
- Step 03
It ends by itself
An approved grant must carry an end time, checked on every request, so it stops working the moment it lapses. Revoke it sooner whenever you like.
expiry on read
- Step 04
Every reach is recorded
Each read or write by our staff lands in your audit log, with the grant it was made under.
your audit log
Two settings, and the recording is the same in both
Your owner or admin picks the setting on your own organization page. With a grant required, our staff reach your organization only while a grant you approved is live. In the open setting they can reach it without one. Either way every reach is recorded, and if the grant check itself fails, the gate denies rather than allows.
Audit log
A record your own admins read
Every sensitive change writes a row: gate decisions, benefit validations, accepted revisions, edits and deletions of deliverables and comments, member changes, and every reach by SigmaForge support. Owners and admins read it inside the product, filter it by action and date, and export it as CSV.
- Who did it, what they did, and when
- Filter by action and date
- Export as CSV for your own records
- 1Who, what and whenEach comment and change, as it happens.
- 2Named rolesEvery person on the project, with their role.
Your data
Four ways in, and the spreadsheet is read on your machine
Paste values
Type or paste a column of numbers straight into the tool.
Upload Excel or CSV
The spreadsheet is parsed in your browser, so the file never has to leave it to be read.
Drop a screenshot
A photo or screen capture of a table is read back as rows you can check before you use them.
Use project measurements
Pull the readings your team already recorded on the project collection sheet.
- 28of 32
Figures computed, not generated
Most analyses compute their numbers in a deterministic engine. The model writes the explanation over the top, and cannot move the figures.
Encryption at rest, per organization
Measurement values and saved project documents are encrypted with a key for each organization (AES-256-GCM), stored only in wrapped form. It is switched on per deployment, so ask us to confirm it for yours.
Yours to take with you
The audit log exports as CSV, each project as a dossier PDF, and each document as a branded PDF.
Can SigmaForge staff open our projects?
Your organization chooses. With a grant required, our staff can reach it only under a grant your owner or admin approved, for the hours they chose. In the open setting they can reach it without one. In both settings every reach is written to your audit log, and if a grant check fails the gate denies rather than allows.
Can another customer ever see our data?
Every project record carries its organization, the database refuses a row that claims a different one, and row-level security scopes every read to your organization. Tests sign in as a user of one organization against a live database and assert they cannot see anything in another.
Where is a spreadsheet read when we upload it?
In your browser. The file is parsed on your machine, so it never has to leave it to be read. What you then save into a project is stored with that project.
Does an AI model compute our statistics?
For 28 of the 32 analyses, no. A deterministic engine computes the figures and the model only writes the explanation, so the numbers do not change with the wording.
Who can read the audit log?
Your organization’s owners and admins, inside the product. They can filter it by action and date and export it as CSV.
Security review
Bring your security questionnaire
We answer it from the code, and where the answer is no, we say so plainly.