FastRestfulAPI infrastructure
Live demo Buy licenseBuy
Security / trust center

Security is a surface,
not a slide.

FastRestful treats tenant isolation, key custody, gateway safety, provider settlement, and audit evidence as product behavior. This page explains the boundaries and the controls you inherit — and the ones you must operate.

Tenant isolation

  • Explicit active workspace header
  • Server-side membership checks
  • Immutable ownership fields
  • Separate public serializers
  • Workspace-scoped media and keys
  • Dual-tenancy vendor reads

Key custody

  • Raw keys returned once
  • SHA-256 lookup hash
  • Fernet-encrypted server copy
  • Scoped full / execute / read
  • Rotation and revocation
  • Application-bound subscriptions

Gateway safety

  • HTTPS-only public upstreams
  • DNS validation + pinned IP
  • No redirect following
  • Timeout, body, and upload caps
  • Quota and rate-limit enforcement
  • Redacted response previews

Identity

  • 15-minute access tokens
  • Rotating refresh + blacklist
  • TOTP two-factor
  • OIDC and SAML 2.0
  • Single-use email invites
  • Staff is separate from workspace admin

Money

  • Signed provider webhooks
  • Event IDs recorded once
  • Amount and currency checks
  • Idempotent refunds
  • Monotonic payout states
  • Append-only ledger

Audit

  • Actor + target + metadata
  • Settings and moderation events
  • Provider receipts
  • Append-only ledger entries
  • Export jobs
  • Retention controls

Content

  • Structured sections, not raw HTML
  • Safe link validation
  • Upload signature checks
  • Trusted custom CSS/JS only
  • CSP nonce support
  • Draft/publish separation

Operations

  • Health probes
  • Maintenance mode
  • Shared-cache fail-closed gateway
  • Celery worker separation
  • Backups and restore path
  • Deployment checks
Trust boundaries

What crosses a boundary — and what does not.

FastRestful keeps secrets on the server, isolates workspaces before every database access, and never hands the browser an upstream credential.

01Browser → API

  • JWT or session authentication
  • Explicit workspace header
  • CSRF protection on writes
  • Strict allowed origins
  • No raw provider secret returned
  • No raw API key after creation

02API → database

  • Tenant scoping before query
  • Object-level permission checks
  • Immutable ownership fields
  • Transaction-safe state changes
  • Public/private serializer split
  • Audit events on sensitive actions

03Gateway → upstream

  • Only public HTTPS addresses
  • No private, loopback, or link-local targets
  • No redirects
  • Pinned DNS address
  • Timeout and body caps
  • Redacted logs

04Provider → platform

  • Signature verification
  • Fail closed on missing secrets
  • Event receipt before settlement
  • Amount/currency validation
  • Idempotent retry handling
  • No raw payload retention

05Admin → public site

  • Only published content crosses
  • Draft and legal separation
  • Public branding contract
  • Operational settings stay private
  • Custom assets are trusted operator code
  • Preview is explicitly scoped

06Operator → infrastructure

  • Your database and backups
  • Your object storage policy
  • Your TLS and DNS
  • Your secret manager
  • Your monitoring and retention
  • Your incident process
Hardening defaults

Production is the strict path.

FastRestful fails fast when production configuration is incomplete instead of quietly running with development defaults.

01 / CONFIG

No insecure production start.

Production requires a 50+ character secret, a valid Fernet key, PostgreSQL, explicit allowed hosts, CORS/CSRF origins, and Redis.

  • HTTPS redirect and HSTS
  • Secure cookies
  • Strict referrer policy
  • Deployment check command
02 / ACCESS

Least privilege, by default.

API keys narrow to execute or read. Workspace roles separate billing and team management. Staff access is a separate permission boundary.

  • Owner/admin/developer/billing/viewer
  • Last-owner protection
  • Admin model permissions
  • Two-factor enforcement
03 / EVIDENCE

Retries should not rewrite history.

Provider events and ledger rows are append-only. Replays are acknowledged without double-settling, and uncertain states reserve funds instead of guessing.

  • Provider event receipts
  • Refund reservations
  • Payout reconciliation
  • Audit exports
Shared responsibility

You own the deployment. We make the defaults defensible.

FastRestful is self-hosted. The operator controls infrastructure, providers, and data lifecycle; the platform enforces application-level boundaries.

FastRestfulApplication controls

  • Tenant-scoped authorization
  • Key hashing and encryption
  • Gateway SSRF and quotas
  • Signed provider event handling
  • Audit and moderation evidence
  • Safe public serializers

OperatorInfrastructure

  • Network and firewall
  • TLS certificates and DNS
  • Database patching and backups
  • Redis and worker availability
  • S3 bucket and CDN policy
  • Monitoring and incident response

OperatorProvider accounts

  • Merchant and payout accounts
  • Webhook registration
  • Provider API keys
  • Sending domain authentication
  • Identity provider configuration
  • Negotiated provider terms

OperatorData lifecycle

  • Retention policy
  • Backup encryption
  • Restore testing
  • Export review
  • Legal and privacy copy
  • Jurisdiction-specific controls
No certification claims. This page describes the shipped application controls. FastRestful does not claim SOC 2, ISO 27001, PCI DSS, HIPAA, or any other certification. Operators must complete their own compliance assessment for their deployment and providers.
Report a concern

Found something that should not cross a boundary?

Send a concrete reproduction, affected route or version, and impact. Do not include live API keys, customer data, or provider secrets.

Email a security reportRead the security guide
Evidence flowappend-only
REQUEST → EVENT
API key hash · subscription · quota · endpoint
usage event · request log · audit event · provider receipt