How we handle infrastructure, data and access.
This page describes what we actually do rather than what we aspire to. Where a control is not in place, it is not listed.
AI and automation work
How client automations and agents are kept apart and kept in check.
- Separate projects
- Each client’s automations live in their own isolated workspace with their own credentials, separate from every other client’s.
- Approval before action
- In the AI operations teams we install, agents prepare work but cannot send messages, publish or move money until a named person approves.
- Model providers
- Before we connect anything, we tell you which AI provider will process your data. We do not train AI models on client data.
- Sensitive data
- Where regulated or confidential data is involved, we keep it out of AI prompts and inside the tools you already trust with it, or we decline that part of the work.
Infrastructure
Where systems run.
- Hosting
- Production workloads run on dedicated and cloud servers in European and United States data centers operated by established providers. We manage the operating system, services and application layer directly.
- Network
- Services sit behind a reverse proxy with a managed edge network in front of it. Administrative interfaces are not exposed to the public internet; they are reachable only over a private mesh network.
- Transport encryption
- All public endpoints are served over HTTPS with certificates renewed automatically. Plain HTTP requests are redirected. Internal service traffic is confined to the host or a private network.
- Isolation
- Each client system runs with its own application user, its own database credentials and its own storage path. A compromise in one does not confer access to another.
Access
Who can reach what.
- Key-based authentication only
- Server access uses SSH key pairs. Password authentication for administrative access is disabled. Keys are individual, never shared between people.
- Multi-factor authentication
- Hosting, domain, payment and email provider accounts are protected with multi-factor authentication. Recovery codes are stored offline.
- Least privilege
- Application processes run as unprivileged users scoped to their own directories. Database accounts are granted only the permissions the application requires.
- Secrets out of source control
- Credentials live in environment files outside the web root, readable only by the process that needs them. They are never committed to a repository and never embedded in client-side code.
Data
Handling, retention and recovery.
- Backups
- Databases and application data are backed up on a schedule to storage separate from the production host. Restores are tested rather than assumed to work.
- Payment data
- We do not store card numbers. Card data is captured by, and remains with, the regulated payment processor. Our systems hold only the processor’s transaction reference and its status.
- Client ownership
- Client data belongs to the client. On request we export it in a documented format and, on termination, delete our copies within an agreed period.
Monitoring and disclosure
Public endpoints are probed every five minutes and results are published on our system status page. Server-level alerts are delivered to a channel that reaches a person rather than an unattended inbox.
If we become aware of a security incident affecting client data, we notify the affected client directly, describe what we know and what we do not yet know, and follow up with a written account once the cause is established.
Reporting a vulnerability
If you believe you have found a security issue in a system we operate, email [email protected] with the subject line “Security”. Include enough detail to reproduce the issue. We will acknowledge receipt within two business days.
Please do not run automated scanning against production systems, access or modify data that is not yours, or publicly disclose the issue before we have had a reasonable opportunity to address it. We will not pursue action against researchers who act in good faith within those limits.
What we do not claim
Altura Systems does not currently hold SOC 2, ISO 27001 or PCI DSS certification, and has not been assessed for HIPAA compliance. We are a small company and we would rather state that plainly than imply an audit we have not undergone. Where an engagement requires a certified environment, we will say so and help you find one.