Security

Access follows the actor

Admin sessions and customer sessions are separate. Backend authorization, roles, token scopes and recent MFA checks protect sensitive operations.

Content and integrations are constrained

Public body HTML is sanitized; draft previews are signed and short lived. External automation uses scoped, versioned commands that Mars validates again before invoking an owning service.

Updates and recovery

Package verification, write quiescence, private encrypted backups and snapshot based update recovery help operators verify change and restore prior state. Recovery is an operational process, not a promise of zero risk.

The deployment still matters

Server patching, secrets, network controls and monitoring remain the responsibility of the installation operator. Platform safeguards do not replace sound hosting practice.