Security model

Tenant isolation

Organization identity comes only from the authenticated credential. Every repository query includes that organization before data is fetched. Headers and cookies cannot select another tenant.

Default-deny responses

Partner responses are constructed field by field. Database documents, internal DTOs, player snapshots, app configuration, resolved integration data, device diagnostics, credentials, tokens, storage keys, and newly introduced internal fields remain invisible unless explicitly approved.

HTTP protections

• Production requests require HTTPS.
• Credentials are accepted only as Bearer authorization.
• Sensitive responses use Cache-Control: private, no-store.
• Authorization headers are redacted from logs and exception reports.
• Partner response bodies and signed URLs are not logged.

Client responsibilities

• Keep credentials in a server-side secret manager.
• Grant the least privilege needed.
• Rotate immediately after suspected disclosure.
• Validate TLS and do not follow redirects to insecure origins.
• Do not place customer content or credentials in support tickets.