Hosting
Production workloads run on dedicated and cloud servers in European and United States data centres operated by established providers. We manage the operating system, services, and application layer directly.
Security
How we handle infrastructure, data, and access.
This page describes what we actually do rather than what we aspire to. Where a control is not in place, it is not listed.
Infrastructure
Where systems run.
Network
Services sit behind a reverse proxy with a managed edge network in front of it. Administrative interfaces are not exposed to the public internet; they are reachable only over a private mesh network.
Transport encryption
All public endpoints are served over HTTPS with certificates renewed automatically. Plain HTTP requests are redirected. Internal service traffic is confined to the host or a private network.
Isolation
Each client system runs with its own application user, its own database credentials, and its own storage path. A compromise in one does not confer access to another.
Access
Who can reach what.
01
Key-based authentication only
Server access uses SSH key pairs. Password authentication for administrative access is disabled. Keys are individual, never shared between people.
02
Multi-factor authentication on provider accounts
Hosting, domain, payment, and email provider accounts are protected with multi-factor authentication. Recovery codes are stored offline.
03
Least privilege
Application processes run as unprivileged users scoped to their own directories. Database accounts are granted only the permissions the application requires.
04
Secrets kept out of source control
Credentials live in environment files outside the web root, readable only by the process that needs them. They are never committed to a repository and never embedded in client-side code.
Data
Handling, retention, and recovery.
Backups
Databases and application data are backed up on a scheduled basis to storage separate from the production host. Restores are tested rather than assumed to work.
Payment data
We do not store card numbers. Card data is captured by, and remains with, the regulated payment processor. Our systems hold only the processor's transaction reference and its status.
Client ownership
Client data belongs to the client. On request we export it in a documented format and, on termination, delete our copies within an agreed period.
Monitoring and response
Public endpoints are probed every five minutes and results are published on our system status page. Server-level alerts are delivered to a channel that reaches a person rather than an unattended inbox.
If we become aware of a security incident affecting client data, we notify the affected client directly, describe what we know and what we do not yet know, and follow up with a written account once the cause is established.
Reporting a vulnerability
If you believe you have found a security issue in a system we operate, email [email protected] with the subject line "Security". Include enough detail to reproduce the issue. We will acknowledge receipt within two business days.
Please do not run automated scanning against production systems, access or modify data that is not yours, or publicly disclose the issue before we have had a reasonable opportunity to address it. We will not pursue action against researchers who act in good faith within those limits.
What we do not claim
Altura Systems does not currently hold SOC 2, ISO 27001, or PCI DSS certification. We are a small company and we would rather state that plainly than imply an audit we have not undergone. Where an engagement requires a certified environment, we will say so and help you find one.