MetricFold security and trust architecture

Analytics sits inside a sensitive operational boundary. It sees product routes, event names, commercial outcomes and connected-provider metrics. MetricFold therefore treats tenant isolation, secret handling and event authority as product requirements rather than infrastructure details.

This page describes the implemented control model and current boundaries. It is not a certification claim. Formal audit reports, penetration-test summaries, data-region commitments and uptime agreements will be published or contracted only after the relevant work exists.

Tenant and authorization model

Every analytics site belongs to a workspace. Users access a workspace through an accepted membership and explicit role. Site routes resolve the current workspace first, then query the requested site inside that boundary. Missing tenant context fails closed. Cross-workspace access is exercised in automated property and feature tests for reports, API keys, provider connections and deletion paths.

Superadmin access is a separate staff capability and is not inferred from a route or email at request time. Mass assignment cannot grant it. The designated founder account is provisioned through an idempotent command, and its workspace carries explicit unlimited flags rather than bypassing every authorization policy.

Authentication and account protection

MetricFold supports verified email, strong password rules, passkeys and time-based two-factor authentication. Recovery codes are encrypted. Sessions use secure framework controls and state-changing browser routes require CSRF validation. Collector and verified webhook routes are intentionally stateless and remove session and queued-cookie middleware.

Authentication endpoints are rate limited and public forms are designed for bot protection and anti-enumeration behavior. Enterprise single sign-on is reserved for contracted plans and will not be represented as available until it is configured and tested.

Analytics collector boundary

Each site receives an unguessable public collector key and an exact list of allowed origins. A request from an absent or mismatched origin is acknowledged without revealing whether a site exists, then discarded. Payloads have strict size, shape, event-name, property and cardinality bounds. Client events must appear in the site's tracking plan, while trusted server events require a separate credential path.

The default tracker is deferred, small and designed not to read cookies, local storage, session storage, form values or DOM text. Event identifiers are deduplicated inside a site. Bot and malformed traffic is filtered before it reaches the human dashboard, with bounded diagnostics retained separately.

Secrets and provider connections

API keys are shown once, stored as hashes and scoped by workspace abilities and optional expiry. Social OAuth and custom API tokens use encrypted database casts and are never returned to browser props. The custom metric connector accepts HTTPS only, blocks credentials in URLs, public and private IP targets, local hostnames, redirects and nonstandard ports. DNS is resolved and pinned for the request to reduce rebinding risk. Responses are time- and size-bounded, and only one configured numeric JSON path is stored.

OAuth callbacks use a short-lived, single-use state value and PKCE verifier. Multiple accounts are isolated by provider and hashed account identity. Scheduled sync jobs normalize numeric metrics; provider responses are not passed wholesale to dashboards or AI clients.

Billing and entitlement integrity

The browser cannot mark an account paid. MetricFold uses Dodo Payments hosted checkout and signed Standard Webhooks. Product IDs are scoped to MetricFold inside the shared merchant account. Webhook identities are unique, queue admission is durable and repeated deliveries converge on one local event. Subscription transitions are explicit and a late failure cannot overwrite a later active state.

Unknown payment outcomes remain reconcilable. Entitlements are computed from provider-verified subscription state or an explicit trial, with founder unlimited access represented as a stored administrative entitlement. Direct PayPal is disabled because it would move merchant-of-record tax responsibility outside Dodo.

Application and response controls

The application sends a restrictive Content Security Policy with a nonce for the small theme bootstrap, frame protections, MIME sniffing protection, referrer policy and permissions policy. Public marketing pages are server-rendered from Markdown and a closed block registry. Raw HTML and unknown directives fail closed. Authenticated application pages hydrate through Inertia and React with semantic theme tokens.

The API uses bearer keys, per-IP and per-token rate limits, bounded report windows and explicit abilities. MCP calls dispatch to the same application services and do not provide SQL, filesystem or credential access. Server-Sent Event connections have bounded duration and snapshot counts.

Engineering verification

Behavior changes pass unit, integration, contract, property, mutation, boundary, security, race, error, configuration, regression, approval and smoke layers where applicable. The shared deterministic analytics engine hard-fails below 100% mutation score. Frontend release review includes real browser interaction, SSR, hydration, responsive layouts, keyboard focus, automated accessibility, dark contrast, reduced motion and overflow checks.

Dependencies are locked and audited. Deployments run migrations, route and configuration cache checks, queue health, HTTPS collector smoke tests and post-deploy origin verification. Secrets, live databases, logs and credential files are excluded from source and release artifacts.

Incident response and disclosure

Security reports can be sent to [email protected] with a concise reproduction, affected URL, impact and safe contact method. Do not access data that is not yours, degrade service, automate destructive testing against production or publish sensitive details before a reasonable remediation window. Good-faith reports will be acknowledged and triaged; a formal bounty is not promised unless separately announced.

If a confirmed incident affects customer data, MetricFold will contain it, preserve evidence, assess scope, rotate affected credentials, remediate the cause and communicate according to contractual and legal notification duties.