Security, privacy & audit log
Deploy MBio safely with tenant isolation, signed webhooks, secure sessions and a public-only web root.
Production web root
Your Nginx or Apache document root must point to the project public/ directory. Application code, .env, storage and database files must not be web-accessible.
Visitor API security
Sensitive visitor operations validate the site key, session token and conversation ID together. Allowed origins and rate limits provide additional protection.
Secrets
Keep OpenAI, SMTP, Stripe, Twilio, Meta and integration secrets outside the repository. Use environment variables or encrypted server-side settings.
Audit log
Review audit entries for administrative actions, especially changes to integrations, users, billing or assistant behavior.