# FixersTech School Security Architecture Overview **Effective Date:** October 1, 2026 **Version:** 1.0.0 Security and tenant isolation are foundational pillars of FixersTech School ERP. This document outlines our defense-in-depth architecture. ### 1. Architectural Tenant Isolation FixersTech is architected from the ground up for strict multi-tenant safety: - **Tenant-Scoped Data Access:** Every database query executes through our custom `TenantManager` and `TenantQuerySet`, scoping records strictly to the authenticated user's school. - **Cross-School Leak Prevention:** Automated regression test suites continually verify that ID manipulation or parameter tampering across schools is rejected with immediate HTTP 403 / 404 responses. - **Role-Based Access Control (RBAC):** Over 380 granular permissions and 21 pre-configured roles govern access to finance, payroll, examinations, and student health records. ### 2. Transport & Storage Security - **Encryption in Transit:** All web requests, mobile API transactions, and administrative portal interactions require HTTPS over TLS 1.2 / TLS 1.3 with HSTS (Strict-Transport-Security) and secure cookies. - **Password Protection:** User credentials are encrypted using PBKDF2 with SHA-256 password hashing. Raw passwords are never stored or logged. - **Unix Socket IPC:** Internal application services (Nginx to Gunicorn) communicate via high-speed Unix domain sockets rather than unauthenticated public network interfaces. ### 3. Network & Infrastructure Defense - **Private Database & Cache:** PostgreSQL and Redis instances listen strictly on localhost / private interfaces and are shielded from direct public internet ingress via cloud security lists. - **Rate Limiting & Throttling:** REST API endpoints enforce adaptive throttling to mitigate brute-force authentication attempts and denial-of-service vectors. - **Automated Daily Backups:** Databases are snapshotted daily with compressed archives and automated retention rotation to ensure business continuity.

Security & Architecture Overview