Security & Architecture Whitepaper

MagnusOp operates on a strict zero-trust model where no client or internal service is trusted by default. Every incoming request must provide cryptographically verified session tokens, and tenant context (business_id) is always resolved server-side from authenticated sessions—never from client-supplied request bodies.

At the persistence layer, every tenant-scoped table is governed by PostgreSQL Row Level Security policies. Database queries are executed within transactions tagged with the authenticated merchant identity, guaranteeing that database queries physically cannot access another tenant's records even in the event of an application logic bug.

All network communication enforces TLS 1.3 encryption with strict HTTP Strict Transport Security (HSTS). Data at rest is encrypted using AES-256 in automated Neon PostgreSQL clusters. TOTP seed keys and sensitive credentials are encrypted using authenticated HMAC and AES-GCM envelopes.

State-changing financial operations and inventory mutations pass through our shared distributed idempotency helper (withIdempotency()). Inventory tracking uses an append-only ledger model where stock movements are the single source of truth.

Security researchers who discover potential vulnerabilities are encouraged to report their findings responsibly to [email protected]. We pledge not to initiate legal action against researchers acting in good faith under standard coordinated disclosure rules.