Security & multi-tenancy
Multi-tenant leaks are one forgotten WHERE clause away
In most systems, isolation is a filter someone remembers to add in the UI. Miss it once and one workspace sees another's calls, numbers, or customers. Bolted-on RBAC and plaintext provider keys make it worse.
What's in the box.Each one in the product today.
- 01
Role-based access
Every route is guarded by a permission; the UI gates nav and actions on the same permission set.
- 02
Native sign-in
Passwords hashed with scrypt, revocable sessions and optional TOTP; each request carries a verified actor with a role and an org.
- 03
Server-side scoping
Org queries are scoped to the caller's workspace in the data layer — not trusted from the client.
- 04
Encrypted BYO credentials
Any credential you bring is AES-256-GCM encrypted at rest, masked on return, never logged.
- 05
Isolation by construction
Cross-org access throws in the shared ownership check, and a code check flags any workspace-scoped query that does not name its workspace.
The safe path is the only path
Scoping and ownership checks live in shared helpers every service calls, so isolation isn't a thing you remember — it's the default. External callers are pinned to their own org; admins get explicit, audited cross-workspace reach.
- Record
- C-2204
- Owner
- Org A
- auth—
- scope helper—
- ownership—
- audit log—
- starting…
Credentials that are usable in memory and opaque everywhere else
When you bring a Twilio auth token, provider API key, or OAuth token, Mirakash encrypts it with AES-256-GCM at rest, decrypts it only in-process at the moment of use, masks it on every read, and keeps it out of logs entirely. The plaintext never lingers beyond the instant it's needed.
- Kind
- Model API key
- At rest
- —
- database—
- API response—
- logs—
- call process—
- starting…
Explore the platform.
It works with the rest of Mirakash. Here is what connects to it.
- Omnichannel & web chatOne agent across phone, WhatsApp, SMS, email, and an embeddable, white-labeled web chat on your domain.
- API & connectorsServer actions and an API, real env-gated connectors, {{VAR}} interpolation, and agent tools that call your endpoints.
- Telephony & numbersProvision phone numbers in one click across three account models — inbound, outbound, encrypted at rest.
- Use casesA real conversation for six desks, start to finish.
- SecurityRoles, redaction, retention and the audit trail.
- PricingPer minute or per resolution, and what each includes.