Ownership
Your facility holds the data, the keys, and the boundary
Mirket is built to be run by the institution that uses it. Isolation, file access, and account security are enforced by the installation rather than promised by a provider.
Facility isolation
Separate facilities do not share the parts that matter.
- Application processes, PostgreSQL, Redis, and storage namespaces are not shared between facilities.
- Customer configuration is mounted at runtime rather than baked into the application image, so the artifact you run is not specific to you.
- Each role application is served from its own origin, and browser access to storage is limited to those three origins.
Learning files
File access is checked against the request, not against possession of a URL.
- Exact-context access
- A protected check binds the requester’s identity to the exact resource context. Belonging to the facility is not the same as being allowed to open a particular file.
- Deny by default
- Access policy names deny unknown values by default, so a policy gap fails closed rather than open.
- Signed delivery
- Browsers receive time-limited signed URLs from a public storage endpoint. Learning material is not sitting behind a permanent public object URL.
- Separated buckets
- Public, protected, and chat objects live in separate buckets with their own rules rather than one bucket with conventions.
Accounts and sessions
The account flows are where most real attacks land, so they carry explicit invariants.
- Two-factor authentication is part of the sign-in contract, and the development bypass cannot skip it.
- Reset and two-factor tokens are one-time, and only the most recent token for a user stays active.
- Token consumption uses conditional atomic updates, so two concurrent replays of the same token cannot both succeed.
- Forgot-password responses do not reveal whether an account exists.
- There is no authentication bypass outside an explicit development scope.
Communication boundaries
Chat is a place where a learning platform can quietly become unsafe for the people it serves. Blocking and direct-message controls are enforced inside the homeserver itself rather than only in the interface, so a client that ignores the UI still cannot route around them.
What this does not claim
This page describes how the software behaves. It is not a certification, an audit report, or a statement about how any particular facility has configured and operates its installation. If you need those, talk to us about your own deployment.
Do it, step by step.
The manual covers this as a task, with prerequisites, what finishing looks like, and what to do when it does not work.
Bring Mirket to your facility.
Run it on your own infrastructure or let us host it for you. Both licences ship the same product; the difference is who operates the data plane.