Security Policy & Architecture

1. Multi-Tenant Database Isolation

Multi-tenancy on MQZZ.DB is implemented at the PostgreSQL role and catalog layer:

• Every user database is owned by an unprivileged role (`NOSUPERUSER`, `NOCREATEDB`, `NOCREATEROLE`).
• Connect permissions on each database are explicitly revoked from `PUBLIC` and granted solely to the designated owner role.
• Schema access is restricted to ensure zero cross-tenant visibility.

2. In-Transit Encryption (TLS 1.3)

All database connections over TCP port 5432 require SSL encryption (`sslmode=require`). Plaintext database connections are rejected by default. The web application and REST API communicate exclusively over HTTPS with modern cipher suites.

3. Cryptographic Secret Management

All generated passwords and sensitive configuration keys are encrypted at rest using AES-256-GCM. Passwords are never logged in plaintext or stored in cleartext database columns.

4. Vulnerability Reporting

We welcome responsible security disclosures. If you identify a security vulnerability within our platform, please report it directly to security@mqzz.site. We respond within 24 hours.