Security

Security at Melyx

Security is built into every layer of Melyx. From authentication to billing, we design our systems to protect user data, prevent abuse, and keep 17+ live apps running reliably.

Infrastructure

Cloudflare-frontedEvery request passes Cloudflare's WAF, DDoS protection, and TLS termination before reaching origin.

Two regions: EU + TokyoOrigin servers in Dublin (EU) and Tokyo. EU data stays in EU when possible.

Encrypted in transitHTTPS / TLS 1.2+ enforced everywhere. HSTS preload on every domain.

Isolated servicesEach app runs as its own service unit with scoped credentials.

Authentication & Identity

OAuth2 + JWTStandard session model. Short-lived access tokens, HTTP-only refresh cookies.

Magic link & social loginSingle-use, expiring, signed magic links. Google & GitHub OAuth.

Argon2id password hashingModern memory-hard hash. Per-user salt.

Forward-auth at the edgeCaddy forward_auth protects internal apps centrally — no per-app auth code to get wrong.

Payments & Billing

All payments are processed by Stripe. Card numbers never touch Melyx servers — we receive Stripe-issued tokens, not PANs.

PCI-DSS via StripeStripe Elements / Checkout handle the card flow in the browser. PCI scope stays with Stripe.

Signed webhooksEvery Stripe event is signature-verified before it can mutate state.

Subscription controlCreate / upgrade / cancel are webhook-driven and idempotent.

Data Protection

Encryption in transitTLS everywhere. No plaintext traffic between services.

Minimal data principleWe collect what we need to run the product, and nothing more.

Access-controlled internalsAdmin surfaces gated by SSO + per-app role. No shared credentials.

BackupsDaily encrypted database snapshots, retained 30 days.

Abuse & Threat Protection

Rate limitingPer-IP and per-account, tunable per endpoint.

Suspicious-login detectionNew IP, new device, impossible travel — all surfaced and optionally blocked.

Email verificationRequired on every account. Disposable / abuse-domain filtering on signup.

Bot preventionCloudflare bot management + heuristics on signup and checkout.

Responsible Disclosure

If you discover a security issue, please report it responsibly. We acknowledge reports within 48 hours and will keep you informed through resolution. We don't run a paid bug-bounty programme, but we credit researchers who help us ship safer products.

Contact: [email protected]

System Status

Live operational status is available on the status page. For incident notifications, write to [email protected] and we'll add you to the operator list.