Security
How Waivora protects signed records
Isolation enforced by the database
Every record belongs to one organisation, and PostgreSQL Row Level Security checks the signed-in person's live membership on every query. The interface is not the only thing standing between one business and another's records.
Immutable versions and records
Publishing a waiver stores a frozen snapshot of its wording with a SHA-256 hash. A completed waiver cannot be edited or deleted — only marked void, with a reason — and its own hash can be recomputed at any time to show it has not changed.
A narrow public surface
Somebody opening a waiver link can read the published version and submit one record. They cannot list, search or read anything else, and every answer is validated again inside the database against the exact version they read.
Accounts
Passwords are stored as bcrypt hashes. Sessions are random tokens stored only as keyed hashes, expire when idle, and end on password reset. Sign-in is rate limited and accounts lock after repeated failures.
Least privilege
The application connects with a dedicated database role that cannot create objects, bypass security policies or read any other product's data. Techvora's platform console holds no access to waiver content or participants.
Minimal collection
Waivora records what the business asks for, the signature and the time. It does not collect IP addresses, device fingerprints or location with a waiver.
Electronic signatures and waivers are treated differently in different places and for different purposes. Waivora keeps careful evidence of what was agreed; whether a particular waiver is enforceable depends on its wording, the circumstances and local law.