Safe by construction, not by promise.
The strongest guarantees in MAGTOS are enforced where they cannot be argued with — in the database and on the money path. Isolation and money-path integrity are live in production; the wider controls ship built and are active on your deployment.
Forced Row-Level Security
Tenant isolation is enforced in the database, not just the application. Queries run under a NOBYPASSRLS runtime role, so data cannot cross the boundary even if the application layer is wrong.
RBAC + ABAC with a grant ceiling
Access is role-based and attribute-based, bounded by a grant ceiling no role can exceed — you cannot accidentally grant more than the ceiling allows.
Two-person approvals
Sensitive actions require a second person to approve — maker-checker on the operations that move money or change critical records.
Money-path integrity
The price displayed to the customer is the price charged. The money path is guarded end to end so the two can never drift apart.
No card-data path
The business is never in the card-data path. Customers pay on the gateway’s own secure checkout; MAGTOS never sees card numbers.
Self-hosted, same-origin media
Uploaded video is scanned, transcoded and served same-origin — no third-party embed that could leak your customers to another platform.
Application bugs happen. When isolation lives only in the application, one wrong query can leak another business’s data. MAGTOS forces Row-Level Security in the database under a role that cannot bypass it — the boundary holds regardless of what the application does.