# Platform Security

DanubeData takes security seriously. Learn about our security measures, best practices, and compliance.

## Overview

Security features include:

- **Encryption**: Data encrypted at rest and in transit
- **Firewalls**: Network-level access control
- **Isolation**: Secure multi-tenant infrastructure
- **Compliance**: Industry-standard certifications
- **Monitoring**: 24/7 security monitoring

## Data Encryption

### Encryption at Rest

All data encrypted on disk:

**Storage Encryption**:
- AES-256 encryption
- Encrypted by default
- Transparent to applications
- No performance impact

**Database Encryption**:
- Encrypted storage volumes
- Encrypted backups
- Encrypted snapshots
- Key management

### Encryption in Transit

All network traffic encrypted:

**TLS/SSL**:
- TLS 1.2 and 1.3
- Strong cipher suites
- Perfect forward secrecy
- Certificate management

**VPN Support**:
- Site-to-site VPN
- Client VPN
- Encrypted tunnels

## Access Control

### Authentication

**Account Security**:
- Strong password requirements
- Two-factor authentication (2FA)
- Passkeys (WebAuthn) for passwordless sign-in
- Google and GitHub social login
- SSH key authentication
- Configurable session idle timeout (24 hours or 3 hours)

**API Security**:
- API token authentication
- Scoped permissions, including tokens locked to a single project
- Token rotation
- Rate limiting

**Sign-in protection**:
- New-device sign-in alerts, by email and in-app
- Automatic blocking of repeated failed sign-in attempts, with an alert naming the source IP
- Both alert types are configurable in Notification Preferences

See [Account Settings](https://docs.danubedata.ro/account-settings) to manage passkeys, connected accounts, session security, and these alerts.

### Authorization

**Role-Based Access Control (RBAC)**:
- Owner, admin, member roles
- Project-based permissions
- Least privilege principle
- Audit logging

**Resource Permissions**:
- Per-resource access control
- Team-based sharing
- Granular permissions

## Network Security

### Firewalls

Control network access:

- **Inbound Rules**: Control incoming traffic
- **Outbound Rules**: Control outgoing traffic
- **Stateful Inspection**: Track connection state
- **Default Deny**: Secure by default

Learn more: [Firewalls](https://docs.danubedata.ro/networking-firewalls)

### DDoS Protection

Built-in protection against attacks:

- **Layer 3/4 Protection**: Network layer
- **Layer 7 Protection**: Application layer
- **Automatic Mitigation**: Instant response
- **Traffic Scrubbing**: Clean malicious traffic

### Private Networking

Secure internal communication:

- **VLAN Isolation**: Tenant separation
- **Private IP Space**: RFC1918 addresses
- **No Internet Routing**: Internal only
- **Free Bandwidth**: No charges

Learn more: [Private Networks](https://docs.danubedata.ro/networking-private)

## Infrastructure Security

### Physical Security

Data center security:

- **24/7 Security**: Armed guards
- **Access Control**: Biometric systems
- **Surveillance**: Video monitoring
- **Secure Locations**: Undisclosed addresses

### Virtualization Security

Secure multi-tenancy:

- **Hypervisor Hardening**: Minimal attack surface
- **Resource Isolation**: Dedicated resources
- **Kernel Isolation**: Separate kernel spaces
- **Memory Protection**: Isolated memory

### Server Security

Secure server infrastructure:

- **Hardened OS**: Security-focused configuration
- **Automatic Updates**: Security patches
- **Intrusion Detection**: Monitoring and alerts
- **Malware Protection**: Anti-malware systems

## Application Security

### Database Security

Secure managed databases:

- **Encrypted Connections**: TLS required
- **Access Control**: User permissions
- **Network Isolation**: Firewall rules
- **Automatic Backups**: Encrypted backups

### Cache Security

Secure Redis instances:

- **Password Protection**: Required
- **TLS Encryption**: Encrypted connections
- **Network ACLs**: IP-based access
- **Private Network**: Isolated communication

## Compliance

### Frameworks and Standards

DanubeData operates and continues to mature its information security practices in alignment with the following frameworks. Where a third-party certification is not yet held, the underlying controls are nevertheless implemented and audited internally.

**Frameworks aligned**:
- **ISO/IEC 27001:2022 framework** — Information security management controls implemented across infrastructure, operations, and personnel
- **CISPE Code of Conduct for Cloud Infrastructure Service Providers** — GDPR-aligned data protection controls for the European cloud market
- **GDPR (EU Regulation 2016/679)** — Full compliance as a data processor

**Underlying infrastructure certifications**:
- Hetzner Online GmbH (data center provider) holds **ISO/IEC 27001** certification for the Falkenstein and Nuremberg facilities used by DanubeData

**Roadmap**:
- Independent third-party penetration test (planned annually)
- ISO/IEC 27001 certification of the DanubeData management system (planned)
- CISPE Code of Conduct adherence declaration verified by the official Monitoring Body (in progress)

DanubeData does not currently claim independent certification under SOC 2, PCI DSS, or HIPAA. Customers requiring those certifications should treat the platform as an infrastructure provider whose hardware layer is ISO 27001 certified, while application-layer compliance remains the customer's responsibility under the Shared Responsibility Model.

### Data Protection

**GDPR Compliance**:
- Data processing agreement
- Right to erasure
- Data portability
- Breach notification

**Data Residency**:
- Data in selected region
- No unauthorized transfers
- Local compliance
- Data sovereignty

### Audit and Compliance

**Audit Logs**:
- Account activity logs
- Resource change logs
- API access logs
- 90-day retention

**Compliance Reports**:
- Available on request
- Third-party audits
- Penetration testing
- Security assessments

## Security Best Practices

### Account Security

1. **Enable 2FA**: Required for all users
2. **Strong Passwords**: 12+ characters, complexity
3. **Rotate Keys**: Regular SSH key rotation
4. **Limit Access**: Only necessary users

### Resource Security

1. **Firewall Rules**: Restrict to specific IPs
2. **Private Networks**: Use for internal traffic
3. **Regular Updates**: Keep software updated
4. **Least Privilege**: Minimal permissions

### Data Security

1. **Encrypt Sensitive Data**: Application-level encryption
2. **Regular Backups**: Test restoration
3. **Access Logging**: Monitor who accesses what
4. **Data Classification**: Know your data

### Application Security

1. **Security Patches**: Apply immediately
2. **Dependency Updates**: Keep dependencies current
3. **Security Scanning**: Regular vulnerability scans
4. **Secure Configuration**: Follow best practices

## Incident Response

### Security Incidents

**Reporting**:
- Email: security@danubedata.ro
- Response: Within 1 hour
- 24/7 Security team

**Response Process**:
1. Incident detection
2. Containment
3. Investigation
4. Remediation
5. Communication
6. Post-mortem

### Data Breach

If breach occurs:

- Immediate notification
- Detailed investigation
- Remediation steps
- Regulatory compliance
- Customer communication

## Vulnerability Management

### Vulnerability Disclosure

**Responsible Disclosure**:
- Email: security@danubedata.ro
- Response: 24-48 hours
- Bug bounty program

**Patch Management**:
- Critical: 24 hours
- High: 7 days
- Medium: 30 days
- Low: Next release

### Security Updates

Automated security updates:

- OS security patches
- Application updates
- Dependency updates
- Zero-day response

## Security Monitoring

### 24/7 Monitoring

Continuous monitoring of:

- Network traffic
- System logs
- Security events
- Anomaly detection

### Threat Detection

**Automated Systems**:
- Intrusion detection
- Malware scanning
- Behavioral analysis
- Threat intelligence

### Security Alerts

Immediate alerts for:

- Unauthorized access attempts
- Unusual activity patterns
- Security violations
- System compromises

## Customer Responsibilities

### Shared Responsibility

**DanubeData Responsibilities**:
- Infrastructure security
- Platform security
- Physical security
- Network security

**Customer Responsibilities**:
- Application security
- Data security
- Access management
- Compliance within applications

### Security Checklist

- [ ] Enable two-factor authentication
- [ ] Configure firewall rules
- [ ] Use private networks
- [ ] Enable database encryption
- [ ] Regular backup verification
- [ ] Monitor access logs
- [ ] Update applications regularly
- [ ] Security scanning
- [ ] Incident response plan
- [ ] Data classification

## Related Documentation

- [Platform Infrastructure](https://docs.danubedata.ro/platform-infrastructure)
- [Firewalls](https://docs.danubedata.ro/networking-firewalls)
- [Private Networks](https://docs.danubedata.ro/networking-private)
- [Account Settings](https://docs.danubedata.ro/account-settings)