Tenant isolation
Each customer organization operates inside its own company workspace and tenant boundary. Application access is scoped to the authenticated user, company, role, enabled modules, and record-level permissions where applicable.
Authentication and authorization
- User authentication is handled through managed identity services rather than custom plaintext-password storage.
- Platform-administrator access is separated from customer workspace access.
- Backend routes enforce authorization and company scope instead of relying only on browser-side visibility.
- Temporary provisioning credentials are protected and are designed to stop being retrievable after successful first use.
Infrastructure and secrets
- Production API workloads run on managed cloud infrastructure using workload identity and service accounts instead of shipping long-lived service-account private keys with the application.
- Application secrets are kept out of public web bundles and are provided to server workloads through protected runtime configuration and secret-management systems.
- The public web application and the production API are deployed separately to preserve a clear server/browser security boundary.
Data protection
- Production data is stored in managed cloud data services with server-side access controls.
- Sensitive values used for provisioning are encrypted before persistence where retrieval is temporarily required.
- Public requests, customer requests, and internal administrative actions are separated through distinct authorization paths.
Payments
Payment collection is handled through a dedicated payment processor. Ecliptic uses signed webhook verification and idempotency controls to reconcile payment state without requiring the application to store full payment-card details.
Audit and observability
- Important platform and customer actions can be recorded for operational review and troubleshooting.
- Production services emit structured request logs and release identifiers to support incident analysis.
- Administrative operations include activity, system-health, billing, onboarding, automation, and provisioning visibility.
Automation and AI controls
Ecliptic automation and AI workloads use server-side execution paths, bounded retries, permissions, and review controls where supported. AI telemetry is designed to capture operational metadata without intentionally persisting prompts or generated customer content as usage telemetry.
Responsible disclosure
If you believe you have found a security vulnerability affecting Ecliptic, please report it to ecliptictechnologieshq@gmail.com with enough detail for us to investigate. Do not access data that is not yours, degrade service availability, or publicly disclose an unresolved issue before we have had a reasonable opportunity to investigate.