How ERRA protects your formula data.
Your formulations are trade secrets and your records are regulatory evidence. The application controls described here are enforced in code and covered by automated tests.
Looking for a shorter read? See Trust for a skimmable summary, or Status for what we currently report about uptime and incidents.
Tenant isolation, enforced by the database
Each organization's data is isolated with PostgreSQL Row-Level Security. Isolation is enforced at the database level, not by application code remembering to filter. Another tenant's data is invisible by default. Access exists only through an explicit, scoped SharedRecordGrant enforced by the same RLS policy; a recipient cannot overwrite the owner's controlled record. This is a property of the architecture, not a policy we ask our code to follow.
An audit trail that cannot be edited
Every create, update, and delete on your domain data writes an append-only audit record: who, what, when, and the before-and-after state. The application's database role has no permission to update or delete audit rows. The database itself refuses. Label exports are recorded too: who downloaded which panel version, and when.
Approved formula versions are immutable
Once a formula version is approved, it cannot be modified: enforced by database triggers, not just application rules. Reformulation creates a new version; the approved record is preserved exactly as it was. A label PDF can only be generated from an approved, immutable version.
Role-based permissions on every action
Every action in ERRA is checked against the user's role: viewing, editing, approving, and exporting are separate permissions. Approvals require a named human decision, recorded in the audit trail. Passwords are hashed, never stored in plaintext.
Authentication
ERRA supports password authentication and authenticator-app TOTP MFA.
Tested against reality
ERRA's domain engine is covered by thousands of automated tests, including line-by-line comparison of generated Supplement Facts panels with printed labels. The merge gate runs format, type, lint, unit, integration, production-build, and the complete activation browser checks. Deployment requires the separate full-browser suite. If a generated value ever disagrees with the comparison label, we treat it as a release-blocking bug.
Deterministic math: no AI in regulatory calculations
ERRA uses no AI in the product today. Panel values, %DV rounding, allergen derivation, and cost calculations are deterministic, CFR-cited code: auditable and reproducible. No model participates in a label or cost calculation path.
What ERRA learns from
Customer data is not used to train AI models. Opt-in aggregated benchmarks follow the five limits in our privacy policy. If we ever add an AI feature to the product, it will be off for your organization by default and we will tell you first.
Encryption
Data is encrypted at rest with Aurora storage encryption and S3 default encryption in AWS us-west-2. HTTPS with HSTS protects web traffic in transit. Application secrets are managed as encrypted SST secrets and supplied to the application at runtime, rather than embedded in code.
Data ownership and portability
You own your data. A self-serve export of your organization's records, a capped JSON bundle with a truncation manifest if you exceed the cap, is available at any time, alongside CSV exports of key records such as ingredients, formulas, products, and suppliers. A complete copy including files is available as an assisted export. Retention, de-identification, and deletion obligations are governed by the applicable agreement and policy. ERRA does not promise automatic hard deletion when an account closes.
Where ERRA is today
Available now: authenticator-app TOTP MFA with recovery codes, an organization-level require-MFA policy, database-enforced tenant isolation, an append-only audit trail, version-bound electronic signatures and per-account lockout. Approvals use password re-authentication and bind the signature to the exact record signed. These electronic signature features do not establish regulatory compliance.
Planned: SSO, SAML and SCIM provisioning, a SOC 2 evidence period and an independent penetration test. Customer provisioning and deprovisioning are managed inside ERRA. ERRA has not completed a SOC 2 examination or an independent penetration test, and does not hold ISO 27001 registration.
Aurora point-in-time recovery with a 14-day window, document versioning and a documented incident-response plan are in place. A database restore was rehearsed on August 14, 2026. We answer security questionnaires on request. Recovery targets and monitoring coverage are not contractual commitments. Confirmed-breach customer notices follow the Platform Terms.
Contact security@goerra.com with the affected surface, reproduction steps and observed impact. We read every message; this contact channel does not carry a response-time SLA.
For your QA team
- Multi-tenant isolation: PostgreSQL Row-Level Security with per-request tenant context set in a single middleware layer: no per-query hand filtering.
- Audit log: append-only by database privilege: the application role is denied UPDATE and DELETE on audit records. Entries capture actor, organization, entity, action, before/after diff, and timestamp.
- Version control: approved formula versions are immutable via database triggers; reformulation is a new version with full lineage retained.
- Export gating: label PDFs can only be generated from approved versions; every export writes an audit record.
- Regulatory math: pure, unit-tested functions citing the CFR section they implement (21 CFR 101.36 panel rules); thousands of automated tests including line-by-line comparison with printed labels; No LLM participates in any calculation path.
- Numerics: money and quantities are typed: integer minor units or decimals with explicit units of measure, no floating-point label math.