20 May 2026
How NexusBOS isolates your data: RLS all the way down
Tenant isolation enforced by the database, not by good intentions — a look at the security architecture behind NexusBOS.
Most multi-tenant systems isolate customers with WHERE clauses and hope. NexusBOS enforces isolation with PostgreSQL Row-Level Security: the application connects as a non-superuser role that cannot bypass RLS, so a missing filter results in zero rows — never someone else’s rows.
On top of that sit JWT authentication with audience separation for admin tokens, role-based access control with per-module permissions, maker-checker approval on sensitive actions, rate limiting, and append-only audit logs.
Security is also why the licensing system stores only a SHA-256 hash of your machine fingerprint, and why every entitlement is Ed25519-signed so clients can verify it without trusting the transport.