Keep the distribution layer out of the trust anchor.

Shared responsibility

Build pipeline

• protect private signing keys
• compile, sign, and notarize where the platform requires it
• produce the release artifact and adapter-specific signature
• calculate or verify build provenance and integrity before upload

Mateality Releases

• authenticate app-scoped publish keys stored as hashes
• validate bounded release and artifact metadata
• reserve organization storage allowance before presigning
• encrypt stored artifacts at rest and use TLS in transit
• verify object presence and declared byte size before publishing
• serve updater manifests, public metadata, and artifact streams

Installed application

• check the intended channel and target
• validate the response and download
• verify the signature against the trusted public key
• decide how and when to install the update

Tenant and credential boundaries

Dashboard data is scoped through the active organization and Releases product access. Publish keys are bound to one app and only the publish scope exists. Keys are revocable and rate limited by verified key and, when available, client IP.

Server-only release tables use deny-by-default database access with explicit tenant predicates in application queries.

Upload safeguards

• 96 KiB JSON body cap
• bounded names, notes, content type, and signature
• positive integer artifact size and default 5 GiB artifact cap
• lowercase SHA-256 validation
• organization-scoped storage reservation under a database lock
• 32-artifact maximum per draft
• object existence and byte-size validation before publication

Delivery and privacy

Artifacts are stored with server-side encryption and delivered over TLS with range support, ETag, and a generated filename. Product analytics record app, release, target, source, timestamp, delivered bytes, and coarse edge country. The product analytics path is designed not to retain raw downloader IP addresses; ingest rate-limit subjects are hashed.

Report a concern

• Security vulnerability: security@mateality.com
• Suspected abuse or harmful content: abuse@mateality.com

Do not email a harmful binary. The Acceptable Use Policy asks for a safe retrieval method plus the URL, app or release identifier, reason, evidence, and contact details.