---
title: "Row-Level Security (RLS) — Definition & Engineering Context"
description: "Row-Level Security (RLS) is a database access control feature in PostgreSQL that restricts which rows a specific user or role can read, insert, update, or delete — enforcing data isolation at the database engine level rather than the application layer."
canonical: https://erpstack.io/glossary/row-level-security
markdown_url: https://erpstack.io/glossary/row-level-security.md
publisher: ERPStack
---

# Row-Level Security (RLS)

> **Definition:** Row-Level Security (RLS) is a database access control feature in PostgreSQL that restricts which rows a specific user or role can read, insert, update, or delete — enforcing data isolation at the database engine level rather than the application layer.

## In depth

RLS policies are defined directly on database tables using SQL POLICY statements. When a user queries a table, PostgreSQL automatically appends the policy condition — e.g., `WHERE tenant_id = current_setting('app.tenant_id')` — to every query. This means even if a developer writes a query without a WHERE clause, they only see their tenant's data. RLS is the gold standard for multi-tenant SaaS data isolation because it eliminates the risk of application-layer bugs exposing cross-tenant data.

## How ERPStack applies this

We implement PostgreSQL Row-Level Security policies on all multi-tenant ERP databases, ensuring that application bugs cannot accidentally expose one client's data to another — a critical requirement for SOC 2 Type II certification.

## Related reading

- [Multi-tenant Architecture](https://erpstack.io/glossary/multi-tenant)
- [SOC 2 Compliance](https://erpstack.io/glossary/soc2)
- [Role-Based Access Control (RBAC)](https://erpstack.io/glossary/rbac)