mivama docs
Mivama Docs / architecture

Data & security boundaries

Secrets, permissions and isolation

Last verified 8 August 2026 · source-backed

Security depends on minimizing what each process can see and do. A secret is a capability, not configuration to pass through UI responses or general logs.

Trust zones

Secret classes

  • Portal signing key signs the Portal cookie and never reaches the browser.
  • Portal/Core integration secret authenticates server-to-server methods.
  • Stripe API and webhook secrets live only in Core.
  • Runner secrets allow claim/report endpoints, not customer endpoints.
  • Studio uses separate web/session and runner channels.
  • Tenant database and WordPress credentials are generated per service.
  • Migration tokens are scoped to one migration; the human access code is one-time.
  • Codex credentials remain in a workspace auth volume and are excluded from WordPress, releases and API responses.

This handbook lists configuration key names, never deployed values.

Tenant isolation

Each hosting service receives a deterministic Linux identity, Compose project, directory tree, ports, secrets and resource controls. For example, HOSTING-00001 maps to an internal label such as mv_00001. Ansible validates the service spec before creating directories, networks, database and WordPress containers.

Studio uses a separate development copy. Codex has no Docker socket, live database credentials or direct production write access. Only the Studio worker can run allowlisted sync, deploy and rollback operations.

Authorization is checked twice

Portal hides unavailable controls, but Core remains authoritative. Sensitive APIs resolve the authenticated email to the Customer and verify that the requested subscription, service, migration, invoice or project belongs to it. Service secrets authenticate the caller; they do not replace resource ownership.

Data retention

  • Migration uploads and temporary imports follow migration expiry and cleanup.
  • Used Studio attachments are removed after a turn; unused uploads expire within 24 hours.
  • Studio deletion removes the workspace copy, auth state and deployment plans; minimal archive metadata has bounded retention.
  • Cancelled hosting enters a configurable retention window, default 30 days, before exact tenant decommissioning.

Backups can outlive active data until their documented expiry cycle completes. Retention changes must also be reflected in legal TOMs and privacy information.