Security Standards

1 Infrastructure security

• Sovereign hosting: Critical data for Pro / Enterprise tiers resides in Swiss data centers (Infomaniak), benefiting from the world's strongest data privacy laws.
• Network isolation: Each customer environment is logically isolated using containerization and virtual private networks (VPCs).
• DDoS protection: We leverage Bunny Shield and upstream provider defenses to mitigate volumetric attacks and ensure service availability.

2 Application security

• Web Application Firewall (WAF): Active filtering of malicious traffic (SQLi, XSS, RCE) via Bunny WAF for Pro and Enterprise plans.
• Bot mitigation: Integration with Friendly Captcha to prevent automated abuse without compromising user privacy or accessibility.
• Dependency scanning: Automated scanning of Python packages and dependencies for known vulnerabilities (CVEs) before deployment.
• Secure headers: Implementation of HSTS, CSP (Content Security Policy), X-Frame-Options, and other security headers to prevent clickjacking and injection attacks.

3 Data protection

Encryption in transit

• TLS 1.3 enforced on every endpoint, with TLS 1.2 (strong ciphers only) as the floor. Legacy protocols (TLS 1.0/1.1, SSLv3) are disabled.
• Modern cipher suites only: ECDHE key exchange for forward secrecy, AES-256-GCM and ChaCha20-Poly1305 for authenticated encryption.
• HSTS with a long max-age, includeSubDomains, and preload, so browsers refuse to connect over plaintext.
• OCSP stapling and certificate transparency for fast, verifiable certificate validation.

Encryption at rest

• AES-256 volume encryption on all database and backup storage.
• Application-layer field encryption (Fernet / AES-128-CBC + HMAC-SHA256) for the most sensitive columns — e.g. audit-log IP addresses — so they stay opaque even to anyone who can read a raw row.
• Key management: encryption keys are held in a secrets manager, never in source control, and are rotatable without re-deploying application code.

Password & credential hashing

• Argon2id — the current gold standard, winner of the Password Hashing Competition — with memory-hard parameters tuned to make brute-force and GPU/ASIC attacks impractical.
• Every password is salted with a unique, cryptographically-random salt; we never store plaintext or reversible credentials.
• Minimum length and breach-list (k-anonymity) checks block weak and known-compromised passwords at sign-up.

Authentication & sessions

• Mandatory 2FA (TOTP) for all privileged roles — Super User, Sales, and Finance.
• Short-lived JWT access tokens (15-minute lifetime) with rotating refresh tokens, so a leaked token has a tiny window of use.
• Role-Based Access Control scopes every request; tenants are isolated so one customer can never read another's data.

Backups & recovery

• Daily incremental backups and weekly full snapshots, encrypted and stored in geographically distinct Swiss/EU locations.
• Restores are tested regularly so recovery is a routine, verified procedure, not a hope.

4 Operational security

• Access control: Strict RBAC (Role-Based Access Control) ensures employees only access data necessary for their role.
• Audit logging: Immutable logs track all administrative actions, configuration changes, and data access attempts.
• Incident response: We maintain a formal Incident Response Plan. In the event of a breach, affected users are notified within 72 hours in compliance with GDPR and UU PDP.

5 Supply chain security

• Vendors: We rigorously vet our infrastructure partners (Infomaniak, Hostinger, Proton) for SOC 2 or ISO 27001 compliance where applicable.
• Software: We use open-source components with transparent license histories and no "black box" proprietary obfuscation.

6 Compliance & certifications

• Indonesian law: Compliant with UU PDP (Personal Data Protection Law).
• Global standards: Adheres to GDPR principles for EU customers.
• Future roadmap: We are working towards ISO 27001 certification for our Enterprise tier.

7 Reporting vulnerabilities

If you discover a security vulnerability, please report it responsibly to security@hostinga.id. We offer a voluntary bounty program for critical findings.