Skip to content

Security & Isolation

Core requirements

  • Every tenant-owned request resolves a trusted TenantContext from hostname/site/API credential and authenticated membership—not from arbitrary body/query values.
  • Authorization evaluates platform role, tenant membership, business-unit scope and entitlement separately.
  • Background jobs carry immutable tenant/site/business-unit identifiers and re-establish authorization context deliberately.
  • Secrets never live in page/component JSON or ordinary integration configuration fields.
  • Payment and advertising credentials use encrypted secret storage/reference tokens.
  • Custom-site API credentials are scoped, revocable and origin/environment constrained where applicable.
  • Admin impersonation/support access is explicit, time-bounded where possible, and fully audited.
  • File/media authorization prevents cross-tenant object discovery.
  • Rate limits differ by public, authenticated, admin and integration surfaces.

Security zones

Public visitor -> Public API -> tenant/site scoped read + conversion commands
Tenant user    -> Tenant API -> membership + permission + BU/site scope
Platform staff -> Platform API -> platform authorization + audit
Custom site    -> Public/headless API -> Custom contract + scoped API client

Sensitive mutations requiring audit

  • role/membership changes;
  • plan/entitlement overrides;
  • domain verification/activation;
  • payment/refund/withdrawal changes;
  • pricing/availability overrides;
  • booking status overrides;
  • site publication/rollback;
  • integration credential changes;
  • advertising campaign state/budget changes;
  • support impersonation.