Security

Described as it is built, not as a badge wall. If something here matters to a decision you're making, ask us and we'll answer specifically.

• Access & permissions

  • Every endpoint is scope-gated; a token carries only the scopes it was granted
  • Roles are defined per app, and a plan or role change updates permissions with it
  • OAuth clients, API keys, and bearer tokens are separate credential types with separate lifetimes
  • Public OAuth clients are capped to a narrower scope set than first-party ones

• Data isolation

  • Records are scoped per account, and per user within an account
  • Uploads are stored, scoped, and served under the same permission model as data
  • Shared plans run on shared infrastructure; Dedicated runs an isolated deployment
  • IP allowlisting is available on higher tiers

• Payments

  • It is your Stripe account — bring your own or connect through us
  • Customers pay you directly; funds do not route through Foundation MVP
  • Card details are handled by Stripe, not stored by us
  • Usage is counted against plan limits, and access is revoked when payment stops

• Deployments

  • Every deployment is versioned, atomic, and reversible
  • Changes that would affect existing users are flagged before they ship
  • Configuration is explicit, so what is live is what was reviewed

• Identity for larger teams

  • Dedicated apps can run their own OAuth provider, so others log into your app
  • Auth0 is supported for enterprise identity
  • Email verification can be required before an account is usable

This page describes architecture, not certification. Foundation MVP does not currently claim SOC 2, ISO 27001, PCI, or HIPAA compliance. If your procurement needs a specific attestation, contact us before you build against it.