On this page
MSO Cloud is a multi-tenant platform, and tenant isolation is treated as the product's first invariant. The full internal security documentation (threat model, risk register, operational runbooks) is not published; this page states the disclosure process and the guarantees a customer can rely on.
Reporting a vulnerability#
Report suspected vulnerabilities to security@younetgroup.com. Include the steps to reproduce and the scope you tested. Do not test against tenants that are not your own. Reports are acknowledged and triaged; a fix for a confirmed tenant-isolation issue takes priority over all other work.
Tenant isolation#
- Every tenant's data is scoped to its organization, and within an organization to its brands. Isolation is enforced inside the database with row-level security on every org-scoped table, with enforcement active even for the application's own database identity.
- The application runtime connects with least-privilege database identities that cannot bypass row-level security. Privileges are granted from a declared, default-deny manifest and verified by an automated gate that connects as the real runtime identities against live data.
- A request with no tenant context reads zero rows. Cross-tenant access paths exist only as narrow, enumerated database functions with a fixed shape.
Data protection#
- Connector credentials and directory-login secrets are envelope-encrypted with versioned keys; a secret is never logged, never returned by an API, and never included in a portable data archive.
- Buyer-identifying fields are masked at display by default and revealed only by explicit action.
- Backups exclude secret material by construction.
Application security#
- Every mutating endpoint is rate-limited; webhook signatures are validated before parsing; cookies are httpOnly and secure outside local development.
- Static security scanning, dependency auditing, and the tenant-isolation gate run on every push and in CI; a high-severity dependency advisory blocks the release.
- User-supplied HTML is sanitized before rendering; user-supplied numbers pass validation at a typed boundary.
Authentication#
Password, magic-link, passkey, and TOTP two-factor login are supported. Per-organization directory login (LDAP/AD) is available with fail-closed binding, TLS by default, and no automatic account provisioning: a directory user signs in only after an administrator has created the account.