Trust, Security & Privacy

• Accounts are reviewed and approved by an administrator before access is granted.
• Role-based access control: Super Admin, Regional Admin, Provincial Focal, and Validator roles each see only the data appropriate to their scope.
• Provincial Focal accounts are scoped to a single assigned province; cross-province parcel data is not visible to them.
• Password reset is protected by an SMS one-time code with rate limiting and expiry.
• Administrators can disable, reject, or revoke any account at any time.

• Row-Level Security enforces role and geographic scoping at the database level.
• One-time-code records are stored hashed and are accessible only to server processes.
• Sensitive operations (role changes, account approval, dataset deletion, parcel restore) are recorded in audit logs.
• User-facing error messages are sanitized so internal database details are not exposed in the interface.

• Farmer/beneficiary information from official RSBSA datasets imported by authorized staff (name, RSBSA reference number, location, commodity).
• Parcel geometry and attributes (GPX tracks, polygons, declared and verified area, validation status).
• Staff account information (name, email, mobile number, assigned province, role).
• Operational audit logs needed to investigate access and changes.

Data is used only for RSBSA georeferencing, validation, and reporting in support of DA-RFO5 programs.

The application is hosted on Lovable Cloud, which provides managed database, authentication, storage, and serverless function infrastructure. Platform-level controls are managed by the hosting provider; application-level access rules, content, and data handling are configured and operated by DA-RFO5.

Parcels and datasets follow the program retention rules set by DA-RFO5. Soft-deleted records go to a Restore Center where authorized administrators can recover them; permanent deletion is restricted to Super Admins and is recorded in the audit log.

If you are a farmer-beneficiary and want to know what information is held about you, or to request correction, please contact us using the address below and we will route the request to the appropriate office.

If you believe you have found a security issue, please email rfo5.rsbsa@da.gov.ph with details and steps to reproduce. Please do not publicly disclose the issue until we have had a chance to investigate.