MSP NextBeta

Security

How MSP Next protects your data and sessions.

Security Statement

MSP Next is built with a zero-trust, minimal-data architecture. We do not operate a user database, and we never store your MSP credentials on our servers.

Your session is encrypted end-to-end inside a single HttpOnly cookie. When that cookie expires or is deleted, your session is gone — permanently. There is no server-side session record to breach.

All communication with MSP APIs happens server-side through authenticated proxies. Your access token never touches the browser — it stays within the encrypted session cookie.

Session Lifecycle

StorageSingle HttpOnly cookie (never exposed to JavaScript)
Time-to-live1 hour from login, enforced server-side
Cookie flagsHttpOnly · Secure · SameSite=Strict · Path=/
Session renewalNot supported. Session expires after 1 hour. Re-login required.
Server-side storageNone. No server-side session store.

What We Store

Complete transparency about what data MSP Next handles.

Encrypted session cookie

AES-256-GCM encrypted. Never accessible to JavaScript (HttpOnly).

Stored

Your MSP username or password

Credentials are forwarded to MSP API and immediately cleared from memory. Never written to disk or logs.

Not stored

Anonymous page view analytics

Privacy-first analytics via self-hosted Umami. No cookies, no personal data, no tracking across sites.

Stored

Abuse prevention fingerprint

A salted hash of connection metadata. Used only for rate limiting. Cannot be reversed to identify you.

Stored

Your IP address

Hashed with salt for rate limiting. Raw IP is never stored or logged.

Temporary

Chat messages or friend lists

Fetched from MSP in real-time, rendered, and cleared from memory. Never cached or stored server-side.

Not stored

Payment or billing information

Payments are handled entirely by MSP. We redirect to their official payment page.

Not stored

Rate Limiting & Abuse Protection

MSP Next uses server-side rate limiting to prevent abuse. Limits are applied per account, per IP, and per fingerprint across multiple layers.

Protection layers

  • Per-account limits on all sensitive operations
  • Per-IP limits to reduce automated abuse
  • Per-fingerprint limits as additional defense
  • Runtime locks to reduce concurrent abuse

Responsible Disclosure

If you find a security vulnerability in MSP Next, please report it responsibly. We take every report seriously.

How to report

Join our Discord server and open a ticket in the security channel, or contact an admin directly via DM.

Process

  • Acknowledgment within 48 hours
  • Status update within 7 days
  • Fix deployed as soon as verified

Please do not

  • Publicly disclose the issue before we confirm a fix
  • Use the vulnerability to access other users' data
  • Perform any action that could harm the service or its users