Network & Endpoint Security Statement

Version 1.0 — 9 October 2026 · Companion to the Information Security Policy

1. Network segregation

• Each application (web frontend, API, database, worker, integration services) runs in a separate Docker container attached to a dedicated, per-application internal network. A service can communicate only with the specific containers it is explicitly wired to.
• Inter-service traffic that crosses hosts travels exclusively through an encrypted WireGuard mesh VPN (private 100.x addressing); it never traverses the public Internet unencrypted.
• A single hardened reverse proxy is the only public ingress. Internal ports (databases, admin panels, message brokers) are bound to private interfaces and are unreachable from the Internet.
• The office/home LAN is untrusted by default: no production port is forwarded from the router other than HTTP/HTTPS; administrative access requires the VPN and SSH key authentication.

2. Threat monitoring and prevention

• fail2ban monitors authentication services and automatically bans sources with repeated failures.
• Automatic OS security updates (unattended-upgrades) close known vulnerabilities without manual delay.
• TLS everywhere (HTTPS only, HSTS, automatic certificate renewal) protects data in transit against interception and tampering.
• Deployed services expose the minimum functionality: read-only where possible, no debug endpoints in production, secrets outside the codebase.

3. Endpoint protection

• All endpoints used for company administration run supported Linux operating systems with automatic security patching; there are no Windows endpoints without anti-virus protection in the fleet.
• Application software is installed only from the distribution's signed repositories or first-party sources; integrity of deployed code is ensured through private, access-controlled version control with an audit trail.
• Browser-based administrative sessions use multi-factor authentication wherever the service supports it.