01
Tenant isolation
Every dashboard read resolves membership before it accepts a site. Roles are checked at the shared data boundary, and foreign site ids return no existence signal.
Security
Boundaries you can inspect
This is an implementation summary, not a certification badge. It separates controls enforced by Mayfly from controls the deployment operator still owns.
02
Browser event integrity
The public collector requires both the event URL and the browser Origin to match the configured site. Shared serverless limits and bounded standalone limits constrain poisoning and storage cost.
03
Account protection
Passwords use memory-hard scrypt. Session tokens are random, stored only as SHA-256 hashes, expire, and are revoked server-side on logout or password reset. Transactional mail uses an encrypted, leased, retrying outbox rather than a request callback.
04
Read-only Google access
Search Console requests one read-only scope. Refresh tokens use AES-256-GCM at rest; OAuth state is signed, time-bound, user-bound and cleared after callback.
05
Crawler egress boundary
Audits allow public HTTP(S) on ports 80 and 443 only. DNS answers, redirects and remote socket addresses are checked against private, metadata and reserved networks.
06
Deletion that verifies
Site erasure disables collection, drains cache and in-flight windows, synchronously removes every physical analytics table, verifies zero rows, then deletes control records.
Deployment boundary
What the operator must do
| Transport | Terminate TLS, keep APP_URL on HTTPS and restrict database endpoints to trusted networks. |
|---|---|
| Secrets | Generate independent high-entropy auth, cron and OAuth-encryption secrets; rotate them through the hosting platform. |
| Availability | Monitor the readiness endpoint, collector rejection/error metrics, email-outbox drain, scheduled salt age, Search Console sync and crawler jobs. |
| Edge abuse | Put a WAF and global traffic ceiling ahead of the public collector. Application limits are a second boundary, not DDoS protection. |
| Backups | Set and document Postgres WAL, snapshot and ClickHouse backup expiration; live deletion cannot erase an offline provider copy instantly. |
| People | Limit production access, log administrative changes and establish an incident-response contact before customer data is accepted. |
Current assurance
No borrowed trust marks
Mayfly is not currently SOC 2 or ISO 27001 certified and has not published an independent penetration test. Those are paid-launch procurement gates for customers who require them; they are not implied by the controls above.
Coordinated disclosure
Report a vulnerability
Use the first Contact URI in Mayfly’s security.txt. The contact is supplied by the deployment operator and carries a fixed review deadline rather than an automatically renewed one.
Send enough to reproduce
Affected URL or component, security impact, minimal reproduction steps and any relevant request identifiers. Remove credentials and customer data from screenshots or logs.
Stop at the boundary
Do not retain, modify or download data that is not yours. Stop testing if access crosses an account boundary or could degrade the service, then report what you observed.
No invented program terms
Mayfly does not currently publish a bug bounty, safe-harbor promise, response-time SLA, acknowledgments page or report-encryption key. None is implied by this reporting route.