Data security

Adminmate was designed so that your data stays under your control. This page explains the security model and the settings you can use to harden it.

Your data stays on your servers

The Data API runs on your infrastructure and queries your database with your own models. The content of your database is sent from the Data API to the browsers of your team, and never goes through nor is stored on Adminmate servers.

Adminmate stores the configuration of your project (environments, teams, layouts, dashboards), the comments of your team and the activity log. The activity log records who did what, when, and on which records — not the values of your data.

Two locks

Reading your data requires two independent credentials:

1. a valid Adminmate session, with permissions signed with your project secretKey;
2. the master password of the environment, checked by your Data API only.

An Adminmate account alone is not enough to read your data: the master password is checked by your Data API and never sent to Adminmate servers.

The Data API waits 2 seconds before answering each login attempt, to slow down brute-force attacks. A session lasts 7 days, then the master password is asked again.

Credentials

Credential	Recommendation
masterPassword	Use a long, unique password. Use a different one for each environment. Share it through a password manager.
authKey	Use a random string of at least 32 characters. Changing it logs everybody out of this Data API.
secretKey	Keep it secret. If you think it leaked, contact us at [email protected].

Store them in environment variables or in a secret manager, never in your code or your git repository.

IP filtering

Restrict access to the Data API to a list of IP addresses, for example your office or your VPN:

module.exports = {
  // ...
  authorizedIps: ['203.0.113.10', '198.51.100.24']
};

Requests from other IP addresses are rejected with the not_authorized_ip error. Leave the list empty to allow all IP addresses.

Caution

The IP address is read from req.ip. If your Data API runs behind a proxy or a load balancer (Heroku, Render, Nginx, Cloudflare…), configure Express so that req.ip is the real IP of the visitor, for example with app.set('trust proxy', 1). Otherwise every request has the IP of the proxy.

Restrict what can be done

• Only expose the models your team needs in the models array.
• Use model options to make sensitive models read-only for everyone.
• Use team permissions to give each team access to the environments, models, fields and actions it needs, and nothing more.
• For an extra layer, connect the Data API to your database with a user that only has the privileges it needs.

Network

• Always serve the Data API over HTTPS in production.
• The Data API only accepts browser requests coming from *.adminmate.io (and localhost for development), thanks to CORS.
• If your Data API is only reachable from your private network or VPN, Adminmate works as long as the browsers of your team can reach it.