Technical overview

How MergeMind Platform works

The architecture, security model and operational shape of the platform — for engineers evaluating whether to build on it.

Request model

One edge, verified identity everywhere

gateway · identity propagation

Client → Gateway → Service

  Gateway validates the JWT once, then signs and injects:
    X-User-Id            X-Tenant-Id
    X-User-Roles         X-User-Permissions
    X-Gateway-Signature  X-Gateway-Timestamp   (HMAC)

  Downstream services verify the signature — never the JWT.

Docs

Sections

What’s in the docs

Each section covers one property in depth — what it guarantees, how it's enforced, and where the seams are — and the API reference lists every operation of the core services.

Quickstart

The real path from request access to your first authenticated call — today, not aspirationally.

API reference

Every operation the core services expose through the gateway, read from the running platform and dated.

Authentication & the request model

The Zero-Trust gateway, signed identity headers, MFA and token security.

Tenancy & isolation

How tenant context is resolved and enforced — never trusted from the caller.

Authorization: RBAC + ABAC

Role and attribute-based access control, and how permissions are declared and enforced.

Billing & the ledger

Subscriptions, invoices and a double-entry ledger, with real payment processing.

Events, audit & workflows

The transactional outbox, the audit trail, and sagas for cross-service operations.

Deployment & observability

Container tiers, self-hosting vs. managed, and what you can see at runtime.

Getting access — API & SDKs

What’s available today, honestly, and what’s on the way.

Quickstart

Want to build on it?

Request developer access for the API, SDKs and a sandbox tenant — or get a free Build Review mapping the platform to your product.