Security and governance
Systems built to be audited.
We design and operate the infrastructure behind our products with least privilege, minimal public surfaces and activity logging. The same rules apply to our clients' projects.
Architecture
Defence in depth.
Each layer knows only what it needs about the next. The closer to the data, the lower the exposure and the tighter the control.
Public edge Only what is strictly needed is exposed to the Internet, always over TLS.
Gateways Intermediate services that verify and connect, without keeping persistent data.
Internal network Private, segmented and authenticated access between systems.
Data Held by its custodian. Every access is logged.
Practices
What we do in every deployment.
- 01
Least privilege
Accounts, services and keys get only the permissions their role needs.
- 02
Secrets out of code
Credentials never live in repositories. They are created and kept where they are used.
- 03
Logging and review
Logs are designed so events can be rebuilt when a review requires it.
- 04
Controlled change
Every change goes through version control, review and a rollback plan.
Responsible disclosure
Found a vulnerability?
Write to us with the details. We review every report and reply to the sender.
security@aiserv.es