Security
How MideSync protects your data
The controls we actually implement, and where they live in the product.
Tenant isolation with Row Level Security
Row Level Security is enabled on the workspace, membership, team, customer, conversation and message tables. Postgres itself refuses a query that would cross a workspace boundary, so isolation does not depend on any single API route behaving correctly.
Authorization decided on the server
Workspace membership, role and resource ownership are re-checked on every request. Workspace IDs, user IDs and role values sent by a client are never treated as authoritative; the server resolves what the caller is actually allowed to reach.
Role-based access
Workspaces carry owner, admin, member and viewer roles. Permission checks run server-side on the API routes and are mirrored by database policies, so a hidden button is never the thing enforcing access.
Credentials kept out of the browser
The service-role key, payment secrets and channel provider tokens are server-only. Channel credentials for WhatsApp, Telegram and Meta are held in Supabase Vault rather than in database rows readable by the client.
Verified webhook intake
Inbound webhooks are verified before any work happens: WhatsApp payloads against the app secret signature, Telegram against the per-workspace secret token header, and Meta against its verify token. Unverified requests are rejected rather than processed.
CSRF protection on state-changing requests
Endpoints that change state require a valid CSRF token, which blocks cross-site requests from a page the user did not intend to act on.
Rate limiting on public endpoints
Authentication, public forms and webhook intake are rate limited so they cannot be used to brute-force accounts, spam submissions or flood the platform.
Workspace audit trail
Workspace activity is recorded so changes to settings, channels and membership can be traced after the fact.
Encryption in transit
Connections to the application and to the database are served over TLS, so traffic is encrypted between your browser, the platform and Postgres.
Report a vulnerability
If you find a security issue, email support@midesync.com with the steps to reproduce it. We investigate reports we receive and will follow up on what we are able to confirm.