Security architecture
Architecture
Mani runs on Railway's managed PaaS with automatic scaling, zero-downtime deploys, and built-in monitoring. All services communicate via private networking. No public database endpoints. CDN and DDoS protection via Cloudflare.
Data flow
User request enters via Cloudflare edge (TLS 1.3). Routed to API server (Fastify on Railway). Database queries via Drizzle ORM to encrypted PostgreSQL. Generation jobs queued via BullMQ + Redis. AI processing via FairStack and Anthropic APIs. Results stored encrypted, served back to user.
Encryption
At rest: AES-256-GCM for all data (database, backups, file storage). In transit: TLS 1.3 for all connections (HTTPS, database, Redis). Key management: AWS KMS via Railway. Keys rotated automatically. We do not have access to encryption keys.
Network security
Cloudflare WAF with managed rulesets. DDoS protection (volumetric + application-layer). IP allowlisting available on Enterprise plans. Rate limiting per tier. Bot detection. No public database or Redis ports.
Vulnerability management
Dependency scanning via GitHub Dependabot (continuous). Critical vulnerabilities patched within 48 hours. Annual penetration testing planned (Q4 2026). Responsible disclosure program via security@maniai.com.
Incident response
Documented IR plan: identify, contain, eradicate, recover, post-mortem. Enterprise SLA: 4-hour customer notification for P1 incidents. Blameless post-mortem within 5 business days. Customer-facing summary published.
Talk to enterprise sales
30-minute discovery call. Custom proposal within 48 hours.
Contact sales