For anyone who wants the specifics under the plain-English summary above:
- Public HTTPS/TLS terminated in front by Nginx Proxy Manager (NPM), with the application kept simple and locked down on a private network.
- Brute-force and abuse protection with fail2ban, rate limiting, and GeoIP filtering to shrink the attack surface.
- Firewall rules, least-privilege access, hardened server configuration, and clear separation between public and private services.
- Application code, dependencies, and the underlying platform are reviewed against known CVEs and common exploit classes, with EPSS-driven prioritization.
- Role-based access control (RBAC), optional two-factor authentication, strong session handling, and protected admin areas.
- Backups for application files and databases, replicated to additional backup servers and validated as part of maintenance.
- Ongoing dependency review, OS/runtime patching, and uptime/health/storage/SSL monitoring.
Datacenter compliance & assurance standards
PCI DSSSOC reportsHIPAAISO 27001SSAE 18HITRUST
The hosting foundation uses a datacenter environment with major compliance and assurance standards such as PCI DSS, SOC reports, HIPAA, ISO 27001, SSAE 18, and HITRUST. Application-level compliance depends on the app, data, policies, and controls required.