Controls

All public hostnames are served over HTTPS with certificates issued by Let's Encrypt. HTTP is redirected to HTTPS and no service is reachable over plain text.

Only the ports a service needs are open (SSH, HTTP/HTTPS and the mail submission/IMAP ports). Internal panels bind to 127.0.0.1 and are reached over a WireGuard VPN, never from the internet.

Unattended upgrades are enabled on the host, so security updates are applied automatically and remain traceable in the package log.

Each application runs in its own container with a memory limit; databases are never published on a public interface.

Password authentication is disabled for SSH. Only key-based authentication is accepted.

Each application connects with its own database credentials. Administrative interfaces carry an additional authentication layer and are not reachable from the internet.

Access to production is reviewed when the monthly service report is produced and pruned; the review is recorded.

All customer traffic is TLS 1.2+ with modern cipher suites. Mail transport is TLS with DKIM, SPF and DMARC published for our domains.

Databases, configuration and application data are backed up nightly. Archives are encrypted with restic (AES-256) before leaving the server and stored with a separate provider.

Every backup run includes an automated restore test of the archive it produced; a backup that cannot be restored counts as a failed backup.

Backups are kept on a rolling schedule. On request, customer data is deleted from production within 30 days and ages out of backups within the retention window.

Every public service is probed at short intervals by an independent monitor; downtime alerts the operator on the phone via Telegram.

CPU, memory, disk and container health are collected by a dedicated agent with threshold alerts.

Application and reverse-proxy logs are retained on the host and reviewed when alerts fire; a centralised log search is being rolled out.

A written runbook covers detection, containment, customer notification and post-incident review; it is exercised on real incidents as they occur.

Changes are applied from version-controlled sources; internet-facing changes are checked with a configuration validation step before reload.

Every change to the reverse proxy or service configuration is preceded by a timestamped copy of the working configuration, so a bad change can be reverted immediately.

A separate staging environment for customer-facing applications is planned; today changes are validated on the production host with rollback copies.

A KVKK/GDPR data processing agreement can be signed before onboarding. Subprocessors are listed publicly on this page.

Customer data is hosted in Frankfurt, Germany. Backups are encrypted before transfer and stored with a US provider under standard contractual clauses.

Customers are notified without undue delay, and no later than 72 hours after we become aware of a personal data breach affecting their data.

No ISO 27001 or SOC 2 certificate is held today. This page states what is actually implemented instead of claiming a certification we do not have.