Security
Our approach
Security is foundational to a multi-tenant platform holding business-critical fashion ERP data — designs, customer information, financial records, and vendor relationships. Here's how we protect it.
Multi-tenant data isolation
ModaFlow uses a database-per-tenant (silo) architecture — every Tenant's data lives in its own isolated MySQL database, not a shared schema with row-level filtering. This means one Tenant's data is structurally separated from every other Tenant's, not just logically filtered.
Authentication & access
- Laravel Sanctum token-based authentication, with a composite bearer format (tenant ID plus token) enforcing tenant scoping on every request
- Role-based access control (RBAC) with per-module, per-action permission toggles — your account's pooled users are assigned roles that determine exactly which modules and actions each person can access
- Device locking for mobile: a self-generated device UUID is persisted through logout, locked server-side on first login, and mismatched devices are rejected — with an admin "Reset Device" action available to revoke all tokens if a device is lost or compromised
Infrastructure
- Hosted on dedicated VPS infrastructure running Ubuntu, Apache 2.4, and PHP-FPM
- HTTPS enforced platform-wide via Let's Encrypt/Certbot-issued TLS certificates
- Regular security patching of the underlying OS and dependencies
Application security practices
- Additive-only schema changes — no destructive database migrations are made without explicit internal sign-off, protecting existing Tenant data from accidental loss
- Structured, evidence-based testing before any feature reaches production, including negative-case verification (e.g., confirming one employee cannot access another employee's records)
- Flow Automation integrations (WhatsApp, email, SMS) run through dedicated, tenant-scoped webhook handlers so incoming messages can only update the Tenant they belong to
Data backups
Regular backups are maintained to protect against data loss, with the isolated per-tenant database structure allowing individual Tenant restoration where needed.
Responsible disclosure
If you believe you've found a security vulnerability in ModaFlow, please report it to security@modaflow.net rather than disclosing it publicly. We will acknowledge reports and work to address verified issues promptly.