Castorix serves many municipalities from one system. A fair question from any clerk is: what stops the next town from seeing our residents?
Most software answers “our code checks”. We do that too. But code has bugs, so we added a second lock that lives in the database itself.
How it works
Every row, whether a resident, a library loan or a web page, carries your municipality's identifier. When a request comes in, the database is told which municipality it is serving. A rule inside Postgres, called row-level security, then refuses to return any row that belongs to someone else.
It's like a filing cabinet where each drawer only opens for the town whose name is on it, no matter who is holding the key.
What this means for you
- An error in a report or a screen can't leak another town's data.
- Auditors can verify the rule in the database, not just take our word for it.
- Every staff change is also written to an audit log.