Security architecture
How the control plane, the Executor, and your identity provider fit together. For the product-shaped version of the same diagram, see Architecture.
Ownership, risk, and people
Governance
Security is led by engineering leadership, with company-wide policies for acceptable use, access, incident response, change management, and software delivery.
Risk management
A risk register is reviewed periodically across infrastructure, application, Executor endpoints, and third-party services.
Employee access
Background checks where legally permitted, security training, and least-privilege access to systems and data. Production administrative access is restricted, audited, and time-bounded.
Tenants, encryption, and the network edge
| Control | Practice |
|---|---|
| Tenant isolation | Logical isolation at the application and data layers. Identifiers are validated and scoped by workspace and organisation. Each organisation has its own database. |
| In transit | TLS 1.2 or higher for client-to-service and service-to-Executor communications. |
| At rest | AES-256 or provider-managed encryption for databases, object storage, and backups. |
| Key management | Keys are rotated and access-controlled. Production keys are restricted to secure runtime environments. |
| Segmentation | Public edges are separated from private services. Administrative interfaces are restricted. |
| Ingress | Traffic is filtered and rate-limited, with automated blocking for abusive patterns. A WAF sits on the public edge. |
| Patching | Base images and OS packages are updated regularly, with automated vulnerability notifications. |
The data plane does not open inbound holes
Executors establish outbound TLS connections to Migratrix to register. No inbound port is required for that path. Browser-to-Executor live sessions use the Executor's public URL, which you control.
Short-lived tokens tied to organisation, workspace, and environment. Executor actions are logged with correlation identifiers.
The Executor should run with only the OS and database permissions required for the operations you enabled.
How the product itself is changed
Review and scanning
Code review, dependency scanning, static analysis, and infrastructure scanning on change. Third-party libraries are pinned with a small dependency set.
Secrets
No plaintext secrets in code. Short-lived CI tokens backed by secret stores.
Rollout
Peer-reviewed pull requests and controlled rollouts with monitoring and rollback.
RBAC in the product
Fine-grained, environment-aware roles so production write is not a global workspace permission.