Security

Insurers price on Pruva numbers, so the access rules cannot depend on the app behaving. Each rule below is enforced in Postgres with row-level security, column grants or triggers. Each has a test in the RLS suite that signs in as the relevant role and checks that the forbidden action fails.

The 13 rulesCopy Anchor Link

1. Only the store changes what a workspace has paid for. Tier, state and period end on an entitlement can be written only by the store's service role. An owner who tries to set a module active gets an error.
2. New modules start locked, and a locked module cannot be switched on. Entitlements default to locked. An owner cannot enable a locked module, for example Documents in the demo.
3. Readings are written only by the service. Sensor data, risk scores, emissions, CII ratings and policies have no insert, update or delete rights for signed-in users. Not even the owner can change them.
4. Premium decisions need publish, and the reviewer is pinned. Accepting or declining a premium adjustment needs publish on Insurance. The database sets the reviewer to the person making the change; a forged reviewer is overwritten.
5. Notify crew needs publish, and agents can never do it. Marking an alert as crew notified needs publish on Predict. Agents are refused even if someone tried to grant it.
6. Alert model values are read-only. Users can update an alert's status and note. Severity, probability and window are written only by the model.
7. No access means no rows. A locked or switched-off module, or a level of none, returns zero rows from every table in that module. The underwriter reads zero alerts. Everyone reads zero documents while Documents is locked.
8. The underwriter sees only shared vessels. In the demo that is 6 of 18. See Sharing vessels.
9. Notifications cannot be rewritten. Users can only mark a notification read. Changing its title, text or link, for example to a phishing page, fails.
10. Audit entries are written only as yourself. An entry must name the signed-in user as the actor. Writing one in the name of an agent or another person fails.
11. Agents never hold publish, and members cannot change access. Granting publish to an agent fails. Only owners and admins can change access levels.
12. Report submission needs publish and is pinned. Submitting a report needs publish on Emissions. The database records who submitted it and when.
13. Only owners and admins change connections. People choose whether a connector is on, the account and an https endpoint. Status, last sync and problem text come only from the sync service, so a broken connection can't be marked healthy by hand.

Demo modeCopy Anchor Link

• No outside requests. In demo mode the app reads generated data and calls no external service. The end-to-end tests block third-party requests and fail if any is attempted.
• Refused in production. If DEMO_MODE=true and NODE_ENV=production, the app stops at start-up with an error. A public demo with no real data must set ALLOW_DEMO_IN_PROD=1 on purpose.
• Visible. A banner on every page says it is a demo, and every button that would send, publish or spend shows a notice instead.

Outbound requestsCopy Anchor Link

Any URL a user enters, such as a gateway webhook or insurer portal address, goes through the URL guard before it is called. It allows:

• https only, on the default port,
• no user name or password in the URL,
• no localhost, .local, .internal or single-label host names,
• no IP addresses in private or reserved ranges (IPv4 and IPv6).

The caller also checks the resolved address right before connecting, so a host name that later points to a private address is refused.

Safe redirectsCopy Anchor Link

After sign-in, Pruva only redirects to a path on the same site. A next value like //evil.example, a full URL, a backslash trick or a control character falls back to /app.

The store messageCopy Anchor Link

The site signs each checkout with HMAC-SHA256 and a shared secret. The app rejects a wrong signature or a message older than 5 minutes. In production the site will not sign with the built-in demo secret. See Entitlements.

Reporting a problemCopy Anchor Link

This is a private build. Report security issues directly to the Pruva team, not in a public channel.