Security Architecture & Enterprise Governance
How MeritSKU protects merchant intelligence, catalog intellectual property, and commerce credentials through database-enforced multi-tenant isolation, authenticated encryption, and fail-closed operational boundaries.
PostgreSQL 16
Tenant Isolation
Hardware-enforced session row isolation bound to app.current_workspace_id.
AES-256-GCM
Token Cryptography
OAuth secrets encrypted with workspace-bound Additional Authenticated Data. Zero plain secrets.
Revocation
Cryptographic Shredding
Sub-second complete token eradication upon store integration severance.
Hex Nonces
AI Prompt Defense
Cryptographic nonce boundary wrapping to neutralize prompt injection attacks.
Multi-Tenant Database Isolation (PostgreSQL RLS)
Unlike application-level filtering where a single missing WHERE workspace_id = ... clause leaks cross-tenant records, MeritSKU enforces multi-tenancy at the physical database engine level. Every database connection executed on behalf of an authenticated session begins with a transactional constraint setting SET LOCAL app.current_workspace_id = 'ws_...'.
PostgreSQL Row-Level Security policies evaluate this session attribute on every SELECT, INSERT, UPDATE, and DELETE statement. Cross-tenant queries return zero records, and cross-tenant mutations are physically rejected by the database engine.
Token Cryptography & Sub-500ms Revocation
All external commerce platform credentials (Shopify Admin API tokens, WooCommerce consumer secrets, Amazon SP-API refresh tokens) are encrypted at rest using AES-256-GCM. Each encryption key is derived using Google Cloud Secret Manager, and the ciphertext includes the tenant's workspace ID as Additional Authenticated Data (AAD), binding the ciphertext irrevocably to its owning tenant.
When an operator disconnects a store from workspace settings, our automated token shredding pipeline executes in under 500 milliseconds, cryptographically obliterating the stored tokens and verifying zero lingering API reach.
Anti-Enumeration Stealth Architecture
To prevent attackers from discovering valid workspace slugs, internal job error logs, or administrative consoles, MeritSKU enforces stealth rejection across edge middleware and server components:
- Unauthenticated requests to
/workspaces/**302-redirect to/loginwithX-Robots-Tag: noindex, nofollow, noarchive. - Requests to
/admin/**from callers without a verified super-admin claim return a stealth HTTP 404 Not Found, completely concealing the existence of the management console. - Cross-tenant API resource lookups return HTTP 404 Not Found rather than HTTP 403 Forbidden, eliminating oracle enumeration.
AI Defense & Nonce-Framed Prompt Isolation
E-commerce supplier product descriptions and customer reviews often contain untrusted third-party copy. To defend our analytical pipeline against prompt injection and data exfiltration attacks, all external text ingested by MeritSKU is parsed through our cryptographic sanitizer and framed inside unique 128-bit hex nonces.
Furthermore, our enterprise agreements with OpenAI, Anthropic, and Google Vertex AI strictly mandate Zero Data Retention (ZDR) and zero training on customer product data.
SOC 2 Alignment & Claims Integrity
Strict Grounding in Public Claim Ledger (Claim PUB-CLM-022):
MeritSKU architecture is built to SOC 2 Type II security principles (encompassing PostgreSQL Row-Level Security, AES-256-GCM encryption at rest, TLS 1.3 in transit, and immutable write-once audit logging).
*Note: MeritSKU strictly maintains truth-in-advertising standards and does not publish premature or uncertified compliance claims prior to formal independent auditor filing.
Responsible Disclosure & Security Inquiry Form
Submit vulnerability reports, enterprise audit requests, or vendor DPA inquiries. All reports are handled with confidentiality.