Network security

Minimal exposure

Only what's strictly necessary is published to the Internet: the entry gateway that handles requests to your application. All other components (database, internal services, administration) are not accessible from the Internet.

Single, encrypted entry point

All traffic enters through an entry gateway that:

Terminates TLS encryption (see Encryption).
Automatically redirects unencrypted traffic to HTTPS.
Applies rate limiting to mitigate abuse and abnormal request spikes.

Internal segmentation

Within the platform, traffic between components is segmented: by default, each component can only communicate with what it needs. There is no flat network where everything talks to everything. This contains the scope of any incident to a single environment or component.

Administration out of sight

Administrative access does not go through the Internet, but through an encrypted private administration network. The administrative attack surface is thus kept outside public reach. More detail in Secure connectivity.

Summary

Minimal exposure, encrypted where exposed, segmented internally, and administration off the public network.