How we handle your data
No vague promises. Here are the specific controls, tools, and processes we use to protect your business.
Encryption in transit
All traffic to our services travels over HTTPS with auto-renewed TLS 1.3 certificates. We do not accept unencrypted connections.
- TLS 1.3 on all public domains
- HSTS enabled with extended max-age
- Automatic certificate renewal
Multi-tenant isolation
Each customer is a logical tenant with PostgreSQL Row-Level Security (RLS). Even though data lives in a shared database, queries cannot cross tenant boundaries — enforced at the database engine, not at the application layer.
- RLS policies on all tables with tenant_id
- Connections always set app.tenant_id per session
- Cross-tenant access audit by super_admin
Secrets and credentials
No secret is stored in code. Sensitive tokens (payment gateway API keys, DIAN credentials) are encrypted with Fernet before touching the database.
- .env files chmod 600 on disk
- Token encryption with cryptography (Fernet/AES-128)
- Documented rotation in internal runbooks
Infrastructure and access
Dedicated VPS in Germany (Hetzner), SSH on non-standard port with public key only. Fail2Ban blocks malicious IPs. Docker Socket Proxy limits automated agent attack surface.
- SSH key-only (ED25519)
- Fail2Ban active (sshd + nginx-proxy-manager jails)
- iptables + UFW firewall with default deny
Backups and continuity
Automated daily backups of all databases. Snapshots sync to offsite storage (Cloudflare R2) with 30-day retention. Restore tested monthly.
- Daily backups at 02:00 COT (10 databases)
- Offsite sync to Cloudflare R2 at 04:00
- 30-day retention, object-lock immutability
Monitoring and alerts
Uptime Kuma monitors each critical service every 60s. Telegram alerts to operator on failure. Public status dashboard available to anyone.
- Per-service healthchecks (every 60s)
- Real-time Telegram alerts
- 24/7 public status page
Changes and audit
Every critical operation (plan change, DIAN invoice emission, user deletion) is logged in audit_logs with user_id + timestamp + context. Automated agents require human-in-the-loop approval for destructive actions.
- audit_logs table with full traceability
- HMAC-SHA256 signed approval callbacks
- Dry-run default in destructive runbooks
Compliance
SOC 2 and ISO 27001 are on our 2026 roadmap. Contact us if you need a DPA or specific compliance documentation.
Incident response
If we detect a security incident affecting your data, we commit to notifying you within 72 hours with a description of the scope, the affected data, and the mitigation steps taken.
Report a vulnerability: [email protected]