Security

Midaz builds in protections for data integrity, access control, and tenant isolation. It uses strong identity management, fine-grained permissions, and industry-standard practices. This page describes the security architecture Midaz provides by default. It also shows how you run secure and compliant operations.

​

Architecture

---

Midaz applied security by design and threat modeling from the start. It still applies both to every new feature.

• Security by design: Midaz embeds security controls across the lifecycle, from design to deployment. It follows OWASP guidelines such as the OWASP Top 10 and the OWASP Application Security Verification Standard (ASVS).
• Threat Modeling: A structured process identifies, assesses, and reduces security risks before an attacker exploits them. Midaz uses the STRIDE methodology. STRIDE groups threats into six types:
  • Spoofing (e.g., fake authentication in a banking API).
  • Tampering (e.g., altering transaction data mid-request).
  • Repudiation (e.g., lack of audit logs for transactions).
  • Information Disclosure (e.g., leaking sensitive data via API responses).
  • Denial of Service (e.g., overwhelming the API with fake requests).
  • Elevation of Privilege (e.g., exploiting a bug to gain admin access).

​

Shared responsibility model

---

Security is a shared responsibility between Lerian and the customer. The exact split depends on your deployment model.

​

In the BYOC model

In BYOC (Bring Your Own Cloud), you deploy Lerian in your own infrastructure. Lerian secures the application layer. You secure the environment. What Lerian secures:

• Secure-by-design services.
• Proactive vulnerability fixes.
• Security updates: dependency upgrades, security patches, and improvements.

What the customer secures:

• Infrastructure: Harden the OS and container images, manage patches, and apply secure configurations on the hosting platform.
• Network: Implement segmentation, firewalls, and IDS/IPS systems. Adopt Zero Trust principles to protect internal and external communication.
• Database: Set up backups and audit logging. Follow security best practices for data storage.
• Identity & Access Management: Control access to the environment. Use Access Manager to enforce least-privilege policies within the platform.
• Encryption: Encrypt sensitive data at rest and in transit. Consider tokenization or anonymization where appropriate.
• User Data: All user data that Midaz stores or processes stays under your control and responsibility.
• Monitoring: Establish monitoring tools that detect unusual access patterns or suspicious behavior.
• Additional Security Layers: Reinforce defenses with Web Application Firewalls (WAF), anti-DDoS mechanisms, and bot mitigation tools.

​

In the SaaS model

In SaaS, Lerian manages the full infrastructure. Lerian takes on more of the security responsibility. What Lerian secures:

• Everything in the BYOC application layer, plus:
• Cloud infrastructure, networking, and compute environment.
• Database provisioning, encryption at rest, and automated backups.
• OS and container patching.
• Monitoring, alerting, and incident response.
• High availability and disaster recovery.

What the customer secures:

• Business-level access control: Manage users, roles, and permissions within the platform.
• API integration security: Secure the communication between your systems and the Lerian APIs.
• User Data governance: Define and enforce data-handling policies that meet your regulatory obligations.
• Compliance: Make sure your use of the platform aligns with your institution’s regulatory requirements.

​

Identity and Access Management

---

With authentication on, Midaz forwards each request’s bearer token, together with the product, resource and action, to the configured authorization service. Midaz serves the request only when that service answers that the caller is authorized. Access Manager provides this service. Authentication is on when you set PLUGIN_AUTH_ENABLED=true, and Midaz refuses to start without it when you set ENV_NAME=production. Midaz takes the authorization service address from PLUGIN_AUTH_HOST or from service discovery, and protected requests fail when no authorization service is reachable.

​

Option 1: External IAM

An authorization service of your own must answer the same authorization request that Access Manager answers.

​

Option 2: Access Manager Plugin

The Access Manager Plugin manages authentication and authorization for Midaz. It provides:

• User lifecycle management
• Session token handling
• Refresh token rotation
• Application registration and management

​

Tenant isolation on Lerian Cloud

---

On Lerian Cloud, Midaz isolates all resources by tenant at the application layer. This covers organizations, ledgers, accounts, and transactions. Your JWT access token carries the tenant context. On every request, the platform middleware resolves the tenant from the tenantId claim in the token. Your API calls never see data from other tenants. Other tenants never see your data. This isolation works independently of the organization hierarchy. Two tenants can create similar organization structures, and their data stays completely separate.

​

Credential isolation

Each tenant has its own credentials. Midaz never shares them between tenants. One tenant can never authenticate into another tenant’s data. Lerian generates and manages these credentials. They never sit in configuration files or environment variables.

​

Per-tenant resource limits

Lerian Cloud enforces resource limits so that no single tenant degrades others. This is the noisy neighbor problem:

• Kubernetes resource limits: CPU and memory limits on each workload cap how much compute it can consume. This bounds the impact of a spike or a runaway workload.
• PostgreSQL statement timeout: Midaz does not set one itself. Configure statement_timeout on your PostgreSQL roles or databases so no single query can hold resources indefinitely.
• Connection pool per service: each service keeps its own connection pool, with one pool per active tenant. This bounds connection capacity per tenant. One tenant cannot exhaust the database connections that others need.

​

Data protection

---

Midaz enforces double-entry principles by design. Every transaction must have balanced debits and credits. Midaz rejects any entry that fails this validation. This protects ledger integrity. It also protects the system against posting discrepancies.

​

Built-in safeguards

Midaz applies strict validation across all transaction flows to keep data consistent and prevent logic errors:

• Midaz refuses a transaction that would take an internal account’s available balance below zero. When overdraft is enabled on the balance, Midaz records the shortfall as overdraft usage, within the overdraft limit when one is set. External accounts have no floor.
• Midaz verifies account status before any operation.
• Midaz requires a registered, valid asset before it posts an entry.

​

Compliance with LGPD and GDPR

Midaz encrypts the personal data fields of CRM holders and instruments before it stores them. Other data, such as metadata and descriptions, is stored as sent. Midaz handles transaction validation. You protect personally identifiable information (PII). To stay compliant with LGPD, GDPR, and similar data protection laws, we recommend that you:

• Apply encryption to sensitive data, at rest and in transit.
• Use tokenization or anonymization when appropriate.
• Store and manage customer data under clearly defined security policies.

Midaz provides the foundation. You build the safeguards.

​

Responsible disclosure policy

---

If you find a security vulnerability in Midaz, report it directly to our team before you make it public. We support responsible disclosure. We investigate and resolve issues quickly and thoroughly. The steps to report a vulnerability: