Your township data, handled right.
Dekree handles records that are public when they should be and private when they must be. Here is how we keep that line clear, in plain English, for the IT director your supervisor will forward this page to.
Org isolation, enforced at the database
Every table in Dekree carries an org_id and a row-level security policy. One township cannot read another township's data, even by accident, even via the API.
- Postgres row-level security on every table
- Org scoping enforced at the database, not the application layer
- SECURITY DEFINER helper functions for auth context
- No shared buckets; per-org storage boundaries
Encryption, in transit and at rest
TLS for every request. AES-256 for data at rest. Customer documents in private storage with signed URL access for previews.
- TLS 1.3 for all client and webhook traffic
- Storage at rest encrypted via AWS KMS
- Signed URL preview model, no public file paths
- Custom domain support uses your own TLS certificate
Audit trail, append-only
Every FOIA, every meeting, every document action is recorded with timestamp and user. Audit log entries are append-only: they cannot be edited or deleted.
- Timeline tables on requests and meetings
- Access log captures every document read
- PII-scrubbed logs in error tracking (Sentry)
- One-click export for auditors and council
PII handling, deliberate
Sensitive content gets redacted server-side and permanently. We scrub PII from error reports automatically. Original documents are admin-restricted.
- Server-side redaction removes underlying text from PDFs
- Original preserved in admin-only storage
- Automatic Sentry beforeSend hook strips PII fields
- No session replay (would capture screen content)
Roles, scoped per organization
Clerks draft. Supervisors approve. Council views. Each role gets only the surface area it needs. Invites carry one-time tokens.
- Role-based access control on every action
- Cryptographic invite tokens, never returned to clients
- Multi-factor auth via Supabase Auth
- Session refresh handled at the edge
Webhook and integration security
Inbound webhooks verify their source via shared secrets and signed payloads. No deserialization of untrusted input.
- Postmark inbound + delivery webhooks signature-verified
- Stripe webhook signature checked on every event
- Rate limits on every public-facing endpoint
- Strict security headers (HSTS, X-Frame-Options, etc.)
Backups, including your files
Our database platform backs up the database. That is not enough on its own, because it does not cover your uploaded documents. So we run our own nightly backup that includes both.
- Every table plus your uploaded files, exported nightly
- Held off-platform, so a problem with one provider is not a problem with both
- Add-and-update only, so a mistake in production cannot erase the backup
- 14-day plus first-of-month retention
Hidden means hidden
When you hide a document or a folder from the public, it is not just removed from a list. It becomes unreachable, including by anyone who has the direct link.
- Hiding a folder takes everything inside it offline
- A hidden document is not downloadable by guessing or sharing its link
- Working copies attached to a FOIA request stay internal until you release them
- One page shows a clerk exactly what the public can see
Accessible to residents
Your public pages and embeds conform to WCAG 2.1 Level AA, the standard the new federal rule requires of government websites. Verified with automated checks, keyboard testing, and screen reader testing, not just claimed.
- WCAG 2.1 AA verified across every public page and interactive state
- Keyboard-only operation and screen reader support, tested with NVDA
- Contrast holds automatically, even with your own brand colors
- Accessibility Conformance Report (ACR) available on request; no fake badges
Every citation traces to the source. By policy.
The one thing you cannot afford from a records platform is invented law. So we made it a standing rule: every statute citation and every retention period in Dekree comes from a verified primary source, checked against the current text of the law itself, never from memory and never from a plausible-looking guess.
- ✓MCL citations checked against the Michigan Legislature’s own text
- ✓Retention rules quoted from the official DTMB schedules, as printed
- ✓Source-document quirks preserved and flagged, never quietly edited
- ✓The state revises schedules; we watch weekly and re-pull from the source
When you cite an exemption in a denial letter, your name is on it. This is the discipline that lets you trust what Dekree hands you.
Here is the actual stack.
No mystery vendors. Forward this section to your IT director and they can run their own checks.
Where we are. Where we are going.
Dekree is a young Michigan company. We would rather show you the posture your IT director can verify today than promise a certification badge we have not earned. So here is exactly what is true right now.
For sensitive deployments, talk to us. We are happy to walk through specific compliance questions on a call.
Michigan retention schedules applied
ActiveRecords governed by Michigan retention rules per category at upload.
PII redaction and audit logging
ActiveServer-side redaction, append-only access logs, Sentry PII scrubbing.
Your records outlive us
ActiveNightly off-platform backups, an append-only audit trail, and a self-serve full export in Settings: every record as spreadsheets, every set of minutes, and every stored file. No fee, no waiting period. If you ever leave, your records leave with you.
Independent certifications
HonestWe are not SOC 2 or StateRAMP certified today, and we will not claim a badge we have not earned. The infrastructure we run on (Vercel, Supabase) is independently SOC 2 audited; the posture above is what your IT director can verify now. If we ever learn of a breach affecting your data, we commit to notifying you within 72 hours.
Found a security issue?
Email security@dekree.ai. We respond within one business day. We do not pursue legal action against researchers reporting in good faith.
Talk to us about your security questions