// identity & access
Role-based access control
Admin, Editor, and Viewer roles separate administration, read-and-write work, and read-only access. Authenticated requests are also checked against explicit permissions and resource scope.
// security & compliance
Review security controls for feature-management workflows.
This page summarizes product security features.
Product security overview
// security by design
Clear access boundaries. Protected secrets. Traceable changes.
Maxlona enforces authentication, authorization, tenant boundaries, request validation, rate limits, and change history in the server application. The statements below describe implemented product controls; hosting commitments are identified separately.
// tenant boundaries
Organization isolation
Server-side query filters, tenant-aware repositories, and ownership guards scope organization-owned flags, environments, keys, webhooks, and settings to the active organization.
// abuse resistance
Rate limiting and validation
API and SDK capacity is enforced per organization with an additional hashed-key safety limit. Browser traffic is limited per signed-in user with an organization ceiling, while pre-login abuse protection remains network-based. Requests over a limit receive HTTP 429 with retry guidance.
// accountability
Audit-ready activity
Change history records who changed a protected resource, what changed, and when, supporting review and operational investigation.
// account protection
Multi-factor authentication
Email-based multi-factor authentication is available to every user and can be enabled in account settings. When enabled, a password alone cannot complete sign-in.
// audit records
Searchable change history
Authorized users can filter recorded activity and export available audit history as CSV or JSON. Retention is governed by the customer's plan and service agreement.
// encryption
Protection in transit and at rest.
Transport security
Production requests are redirected to HTTPS and responses include HTTP Strict Transport Security (HSTS). TLS protocol and certificate enforcement are provided at the hosting edge and documented for the hosted environment during security review.
Purpose-isolated secret protection
Management keys, streaming keys, webhook signing secrets, webhook API keys, and Stripe credentials are encrypted before database storage. A sophisticated Data Protection implementation uses purpose-isolated protectors to cryptographically separate each credential type. All newly generated keys and secrets use a cryptographically secure random number generator.
// resilience & key assurance
Defined behavior for transient failures.
HTTP and data retries
Webhook delivery makes up to five attempts with exponential backoff beginning at 30 seconds. Each attempt, response status, error, and next retry time is recorded for investigation.
Organization-scoped caching
Server-side evaluation data is cached within the active organization scope and invalidated when configuration changes. SDK cache duration and fallback behavior remain client-configurable.
Cryptographic key generation
Management keys, streaming keys, and webhook credentials are generated with cryptographically secure randomness. Rotation workflows replace stored encrypted values and reveal new secret material only when required by the workflow.
SDK retry, cache timeout, and fallback settings are documented configuration choices. Hosted-service recovery objectives, backup frequency, and backup retention are operational commitments supplied in the applicable service agreement rather than inferred from application code.
// webhook security
Outbound integrations are treated as a security boundary.
Webhook destinations, credentials, signatures, and retries are enforced by the server-side delivery pipeline.
- Only absolute HTTPS destinations without embedded credentials are accepted.
- Private, loopback, link-local, and reserved network destinations are blocked, including after DNS resolution.
- Configured signing secrets produce an HMAC-SHA256 signature for receiver verification.
- Webhook secrets and API keys are encrypted at rest with purpose-isolated ASP.NET Core Data Protection.
- Automatic redirects are refused so signatures are never forwarded to an unvalidated destination. Delivery records expose response and retry activity.
// security questions
Need details for your security review?
Talk with our team about Maxlona's implemented controls and how they fit your organization's requirements.