MALI Security Overview

Last Updated: October 2026

1. Architecture

MALI runs on a production server hosted by IONOS: a Next.js web app, a FastAPI backend and a PostgreSQL database. Changes are tested before release; there is no separate staging environment.

2. Access Control

• Admin tools are limited to admin accounts.
• Any account can turn on two-factor authentication in its Profile. Password and email-link sign-in then also ask for a code from an authenticator app or a backup code.
• Deactivated accounts and revoked sessions are refused by both the web app and the API.

3. Data Protection

• Encryption in transit (HTTPS/TLS).
• Passwords are stored only as hashes.
• Saved data-provider API keys are encrypted in the database.
• Card details go to Stripe directly; MALI never stores them.

4. Monitoring and Logging

• MALI keeps an audit log that admins can review and export.
• After each deploy, every service's health is checked.

5. Secure Development

• Version-controlled deployments.
• Automated tests run on pull requests before they merge.
• Pull requests that touch security-relevant code are scanned with Bandit and Safety; findings are reported but do not block a merge.

6. Incident Response

We investigate security incidents, mitigate impact, and notify affected users where required by law.