Matsivo is a single, continuously maintained cloud application. Every change ships through the same review and deployment pipeline, and security controls live in the platform itself rather than in per-customer configuration.
Secure delivery
- All traffic is served over HTTPS; plain HTTP requests are redirected.
- A Content Security Policy, strict frame denial and cross-origin isolation headers are applied to every HTML response.
- A Permissions-Policy restricts access to browser capabilities the product does not use.
- A machine-readable security policy is published at /.well-known/security.txt.
Input handling and business rules
- Write operations are executed by server-side domain actions, not by direct table writes from the browser.
- Inputs are validated server-side, including payload size limits on device-facing endpoints.
- Client-side code never holds privileged credentials; secrets stay on the server.
Change management
- Database changes are applied as versioned migrations.
- Security-relevant behaviour is covered by regression checks before release.
Questions about this area?
Our team answers security questionnaires and reviews. Write to security@matsivo.com.