Infrastructure security

The production environment and the network around it.

• Production database is not publicly reachable

  The database listens only on private interfaces; no port is exposed to the internet.

  Monitored
• Encryption at rest

  Database volumes, the document store and backups are encrypted with AES-256.

  Monitored
• Encryption in transit

  Every connection uses TLS 1.2 or later, and HSTS is enforced.

  Monitored
• Edge protection

  Traffic passes through a web application firewall with rate limiting and bot filtering.

  Monitored
• Intrusion detection

  Hosts and the edge are monitored for anomalous traffic and access, with alerts to on-call.

  Monitored
• Hardened hosts

  Servers run a minimal image, accept key-based SSH only, and receive security patches automatically.

  Monitored
• Backups with point-in-time recovery

  Encrypted backups are continuous and restored in scheduled drills.

  Monitored