At MiCantera we take security seriously. Here's exactly how we protect your club's information, your players and your finances.
Encrypted communications (HTTPS / TLS)
All communication between your browser or the app and our servers travels encrypted with TLS 1.2+. No data travels in plain text over the internet.
JWT authentication with token rotation
We use short-lived JWT tokens (60 minutes) with automatic refresh-token rotation. If your session expires, the system renews it without exposing you.
Sensitive credentials encrypted
Payment keys (dLocal Go and WOMPI), WhatsApp Business tokens and AI API keys are stored encrypted in the database. Never in plain text.
Per-club data isolation (multitenancy)
Each club lives in its own logical space. Our middleware verifies on every request that you only access your club's data. It's impossible for one club to see another's data.
PostgreSQL database with daily backups
Your information lives in PostgreSQL 16 on dedicated infrastructure, with automatic backups every day and 14 days of retention. You never depend on someone remembering to make a copy.
Containerized, monitored infrastructure
We run in Docker containers behind an Nginx reverse proxy, with Redis for background jobs. Every deployment goes through the same controlled process, no loose manual changes.
Wildcard SSL on every domain
The *.micantera.com domain and each club's custom domains use Let's Encrypt wildcard SSL certificates, renewed automatically. All traffic is encrypted, no exceptions.
Throttling and abuse protection
Authentication APIs have strict rate limiting. Sensitive endpoints are protected against brute force and enumeration attacks.
If you find a security vulnerability in MiCantera, we ask you to report it responsibly before going public. Write to us at info@micantera.com. We commit to responding within 48 hours.
Last updated: July 2026