FURAZHIR / security boundary

Controls are built into the foundation.
Certificates are not simulated.

FURAZHIR combines built-in security mechanisms with project-specific configuration. Those mechanisms do not automatically prove compliance with a law, standard, or a particular customer threat model.

Open demo Review self-hosted deployment

01isolated customer deployment: 1×
02administrator second factor: TOTP
03origin and CORS allow-list: exact
04audit events: append-only

01 / V1 CONTROLS

What protects the administrative surface

Critical actions cross a server-side boundary. The browser receives no infrastructure secrets and is never treated as a trusted environment.

01identity

Token + TOTP and sessions

Administrator sign-in uses a second factor, server sessions expire, and active sessions can be inspected and revoked.

02request boundary

CSRF, origin, and bounded payloads

Mutations verify source and CSRF state, CORS uses an exact list, and input size and shape are bounded before domain logic runs.

03abuse control

Rate limits and idempotency

Public operations are limited, critical commands support safe repetition, and version conflicts do not silently overwrite state.

02 / DATA AND INTEGRATIONS

How the incident radius is constrained

The single-tenant model isolates each customer’s operational state. Further protection depends on the selected network, database, file storage, email, and key-management practices.

01least data

Minimization and audit

The audit trail stores typed operation facts without secrets or raw binary data; sensitive values must not enter URLs or analytics events.

02verify + refetch

Verified webhooks

An inbound provider notification is not treated as truth: after request verification, the object is fetched again through the authenticated API.

03delivery safety

Outbox and controlled retries

External effects use a queue, retries are observable, and failed operations are not lost between the database commit and a network call.

03 / PRODUCTION READINESS

What to verify before using live data

Built-in controls are completed by network, access, backup, and recovery settings in the selected infrastructure.

01infrastructure

Secrets, TLS, and private networking

Unique keys are generated outside the repository; PostgreSQL uses TLS, and internal services are not exposed without a reason.

02recoverability

Backup, restore, and rollback

A backup file alone is insufficient: restoration and release rollback must be exercised in the target environment.

03project requirements

Threat model and legal requirements

RBAC, SSO/SCIM, HA, certification, and compliance with a particular law are not claimed as ready-made features; they require separate design and evidence.

04 / RESPONSIBILITY MATRIX

Where product ends and operations begin

FURAZHIR provides security mechanisms, while the customer team configures infrastructure and applies project-specific requirements.

Area	In FURAZHIR	Customer side
Admin access	Token + TOTP, sessions, revocation	Provisioning, rotation, offboarding
Web requests	CSRF/origin/CORS, validation, limits	Reverse proxy and WAF if needed
Data	Typed access and audit	Region, retention, backup, DB privileges
Integrations	Outbox, retries, webhook verification	Provider keys and network ACLs
Compliance	Technical safeguards	Assessment for the specific project

BEFORE LAUNCH

Security is verified in your environment

A separate installation reduces cross-customer risk, while keys, network access, the database, backups, and personal-data processing still require correct configuration.

01
The public demo is for product evaluation and uses sample data.
02
Each customer installation uses a separate working database.
03
Security is verified in the selected infrastructure before a live launch.

05 / ANSWERS

Questions about this topic

01Does FURAZHIR automatically comply with a law or standard?

No. The product supplies technical controls, while compliance depends on data categories, region, contracts, notices, infrastructure, and the specific owner’s operations.

02Are full RBAC and corporate SSO included?

Current v1 has an administrative boundary, token plus TOTP, and server sessions. Resource RBAC, memberships, and SSO/SCIM are separate project extensions.

03Who is responsible for infrastructure security?

FURAZHIR supplies built-in safeguards. Network rules, database protection, backups, and infrastructure keys remain the responsibility of the infrastructure owner or its technical partner.

06 / RELATED GUIDES

Self-hostedHow to deploy FURAZHIR in your environment: web, migrations, worker, PostgreSQL, S3/SMTP, Docker Compose, health checks, backup/restore, and production acceptance.

Backend APIFURAZHIR API: 7 public v1 operations, OpenAPI 3.1, TypeScript SDK, scopes, rate limits, idempotency, worker/outbox, and 54 internal Studio server routes.

PricingCore at 29,900 RUB, Agency for customer portfolios, and Enterprise for complex environments. Discuss requirements, schedule, and terms before work begins.

VERIFY THE BOUNDARY