Skip to main content
This document defines the security rules, privacy policies, operational constraints, and architectural invariants that govern toorow.
Compliance with these constraints is mandatory for all deployments and connector modules. Any public exposure of an instance running in disabled or static auth mode is strictly prohibited.

​
1. Privacy & Zero-Telemetry Policy

  • No Phone-Home / No Default Telemetry: Self-hosted instances of toorow contain zero default analytics, tracking pixels, or phone-home mechanisms.
  • Optional GA4 Measurement Protocol: Product usage telemetry is strictly opt-in and controlled via environment variables (GA4_MP_MEASUREMENT_ID and GA4_MP_API_SECRET). When left unset, the telemetry emitter is a complete no-op. If configured by an administrator, event data flows exclusively to your designated GA4 property.

​
2. Pre-Live Security Checklist

Before exposing a toorow deployment to any network or production environment, verify all items on this checklist:

​
3. Core Architectural Invariants (AD-1 to AD-32)

toorow enforces strict architectural boundaries to guarantee data integrity, multi-tenant isolation, and predictable agent interaction:
  1. FastMCP Dual-Channel Model: MCP data tools return a short, human-readable text summary for the LLM context, accompanied by a full canonical structuredContent payload for MCP App widgets.
  2. Microkernel Architecture: Source-specific logic lives entirely inside auto-discovered module directories (server/modules/<source>/). The core kernel (server/core/) remains 100% source-agnostic.
  3. Canonical Daily Fact Surface (fact_daily_kpi): Additive daily metrics (impressions, clicks, spend, conversions, revenue) are harmonized into fact_daily_kpi. Non-additive metrics (CTR, CPA, ROAS) are calculated on-the-fly via dbt semantic views.
  4. AD-5 Multi-Tenant Isolation: Every resource request resolves through an organization-rooted access graph. Tenant isolation is enforced at the database and warehouse queries level and validated by CI isolation test suites.
  5. Split Persistence Responsibilities: PostgreSQL owns transactional state, project governance, and audit logs. BigQuery / DuckDB owns analytical facts and marts. No entity has dual writers.
  6. Desktop Admin Viewport: The Admin Console targets desktop viewports (1280px minimum layout, 1440x900 canonical). No mobile administration view is supported.

​
4. Repository Boundaries

This repository enforces a strict boundary between public application components and private workspace assets:
  • Shareable Application: server/, ui/, dbt/, infra/, .github/, root configuration files, and build scripts. Allowed paths are declared in distribution/public-app.toml.
  • Private Workspace: web/, studio/, docs/, _bmad/, _bmad-output/, reviews, and internal brand assets.
  • Export Enforcer: Run python scripts/export_public_app.py to validate public release boundaries before publishing external snapshots.

​
Next Steps & Cross-References

Environment Reference

Inspect complete .env configuration options and default values.

Self-Hosting Guide

Deploy toorow securely on your own infrastructure stack.

Cloud Hosting

Review the GCP Cloud Run architecture and scale-to-zero settings.

Prerequisites

Check required accounts, IAM permissions, and local dev tools.