Security
Last updated 11 August 2026
Security is built into AyaiMQ from the ground up. This page describes the measures that protect your brokers, credentials and data. It reflects our current practices during the beta and will grow as the platform matures.
Encrypted transport
Broker endpoints are served over TLS, and the console is served over HTTPS. Anonymous MQTT connections are refused by default, so every client must present a valid credential.
Credential handling
Broker passwords are hashed with bcrypt and are never stored or displayed in clear after they are created. A generated or reset password is shown to you once, at creation time, and cannot be retrieved again. Console sign in is handled by Supabase Auth.
Tenant isolation
Every cluster runs on its own broker namespace, applied at login. Clients cannot publish or subscribe outside their cluster, so one customer's topics can never reach another's.
Least privilege permissions
Each credential is scoped to publish, subscribe, or both, on the topic patterns you choose. Publish and subscribe are checked against those permissions on every message, and anything not explicitly allowed is denied.
Data access controls
The control plane enforces row level security. A signed in user can only see and manage their own clusters, credentials, connections and audit records. The broker authentication path runs through trusted server side functions that are not reachable from the browser.
Auditability
Connections, disconnections, failed logins, and denied publishes or subscribes are recorded to an audit log you can review, so you can see exactly what your devices are doing and spot anything unexpected.
Infrastructure
AyaiMQ runs on a managed broker (VerneMQ) with a Supabase control plane. Secrets such as service keys and the broker webhook secret are held in server side environment configuration and are never shipped to the browser.
Reporting a vulnerability
If you believe you have found a security issue, please email security@ayaimq.com with the details. We welcome responsible disclosure and will work with you to confirm and resolve genuine issues. Please do not run intrusive testing against the service without our prior written consent.
Beta note
AyaiMQ is in active development. We are hardening the platform continuously and will expand this page, add a status page, and pursue formal assurances as the service matures.