How ERRA protects your formula data.
Your formulations are trade secrets and your records are regulatory evidence. This page separates repository-backed application controls from deployment facts that still require environment evidence.
Looking for a shorter read? See Trust for a skimmable summary, or Status for what we currently report about uptime and incidents.
Tenant isolation, enforced by the database
Each organization's data is isolated with PostgreSQL Row-Level Security. Isolation is enforced at the database level, not by application code remembering to filter. Another tenant's data is invisible by default. Access exists only through an explicit, scoped SharedRecordGrant enforced by the same RLS policy; a recipient cannot overwrite the owner's controlled record. This is a property of the architecture, not a policy we ask our code to follow.
An audit trail that cannot be edited
Every create, update, and delete on your domain data writes an append-only audit record: who, what, when, and the before-and-after state. The application's database role has no permission to update or delete audit rows. The database itself refuses. Label exports are recorded too: who downloaded which panel version, and when.
Approved formula versions are immutable
Once a formula version is approved, it cannot be modified: enforced by database triggers, not just application rules. Reformulation creates a new version; the approved record is preserved exactly as it was. A label PDF can only be generated from an approved, immutable version.
Role-based permissions on every action
Every action in ERRA is checked against the user's role: viewing, editing, approving, and exporting are separate permissions. Approvals require a named human decision, recorded in the audit trail. Passwords are hashed, never stored in plaintext.
Authentication
ERRA supports password authentication and authenticator-app TOTP MFA.
Tested against reality
ERRA's domain engine is covered by more than 1,800 automated tests, including line-by-line comparison of generated Supplement Facts panels with printed labels. Source: an unnamed, founder-controlled, separately incorporated supplement brand that shares a founder with ERRA. Independent customer proof today: zero. The merge gate runs format, type, lint, unit, integration, production-build, and the complete activation browser journey. Deployment requires the separate full-browser suite. If a generated value ever disagrees with the comparison label, we treat it as a release-blocking bug.
Deterministic math: no AI in regulatory calculations
ERRA uses no AI in the product today. Panel values, %DV rounding, allergen derivation, and cost calculations are deterministic, CFR-cited code: auditable and reproducible. No model participates in a label or cost calculation path.
Encryption
The application is designed to use TLS in transit and AWS-managed encryption for database and object storage. Deployment-specific key configuration requires separate environment evidence. The repository configures application secrets through AWS Secrets Manager rather than embedding them in application code.
Data ownership and portability
You own your data. A full export of your organization's data, an audited JSON bundle, is available at any time, alongside CSV exports of key records such as ingredients, formulas, products, and suppliers. Retention, de-identification, and deletion obligations are governed by the applicable agreement and policy. ERRA does not promise automatic hard deletion when an account closes.
Security and assurance limitations
ERRA does not offer SSO, SAML, or SCIM. Customer provisioning and deprovisioning are managed inside ERRA rather than synchronized from an enterprise identity provider.
ERRA does not publish a backup cadence, RTO, RPO, restore-test result, monitoring-coverage commitment, or incident-response SLA today. Those deployment-specific facts require confirmed environment evidence before they can be represented to a buyer. ERRA does not maintain a customer-ready subprocessor list today.
ERRA has not completed a SOC 2 examination, and its formal evidence period has not started. ERRA does not hold ISO 27001 registration. ERRA has not completed an independent penetration test. We can walk through the repository-backed application controls above or complete a questionnaire without representing unconfirmed deployment facts as proven.
If you discover a security concern, contact security@goerra.com. Please include the affected surface, reproduction steps, and observed impact. No response-time commitment is currently offered.
For your QA team
- Multi-tenant isolation: PostgreSQL Row-Level Security with per-request tenant context set in a single middleware layer: no per-query hand filtering.
- Audit log: append-only by database privilege: the application role is denied UPDATE and DELETE on audit records. Entries capture actor, organization, entity, action, before/after diff, and timestamp.
- Version control: approved formula versions are immutable via database triggers; reformulation is a new version with full lineage retained.
- Export gating: label PDFs can only be generated from approved versions; every export writes an audit record.
- Regulatory math: pure, unit-tested functions citing the CFR section they implement (21 CFR 101.36 panel rules); a 1,800+ test suite including line-by-line comparison with printed labels; Source: an unnamed, founder-controlled, separately incorporated supplement brand that shares a founder with ERRA. Independent customer proof today: zero. No LLM participates in any calculation path.
- Numerics: money and quantities are typed: integer minor units or decimals with explicit units of measure, no floating-point label math.