Access Control Policy

Who can reach customer data, and how customers control access to their own workspace.

Version 1.0 · effective 2026-10-29 · owner Franklin Lupichuk, Founder

Inside Rendro

Access to production systems and provider accounts is limited to the founder.
We don't look at customer content except when the customer asks for support or to investigate a security or reliability problem.
Anyone who joins later gets only the access their work needs, and loses it the day they leave.

Sign-in uses email and password: at least 12 characters, email confirmation required, and rate limits against guessing.
Each workspace has four roles: owner, admin, editor and reviewer. Reviewers can comment and suggest but can't approve, export or change settings.
Owners and admins invite and remove members and change roles; these actions are recorded in the audit log.
Two-factor sign-in and single sign-on (SAML) are not available yet; both are on our roadmap.

The database itself refuses to return another workspace's rows (row-level security), even if application code had a bug.
Files are stored privately in a per-workspace folder. Downloads use signed links that expire after 60 seconds.
AI search only looks at the requesting workspace's documents.