Infrastructure Security
oklido runs on enterprise-grade cloud infrastructure with multiple layers of security.
Cloud Provider
We use Amazon Web Services (AWS) for all infrastructure:
| Certification | Status |
|---|---|
| SOC 1/2/3 | Certified |
| ISO 27001 | Certified |
| PCI DSS Level 1 | Certified |
| FedRAMP | Authorised |
| GDPR | Compliant |
Data Residency
All oklido data is stored in the UK:
- Primary region: AWS London (eu-west-2)
- No data transfer outside the UK/EU
- GDPR compliant data handling
Network Security
Virtual Private Cloud (VPC)
- Isolated network environment
- Private subnets for databases
- Public subnets for load balancers only
- Network ACLs and security groups
Web Application Firewall (WAF)
Protection against common attacks:
- SQL injection
- Cross-site scripting (XSS)
- Rate limiting
- Geographic restrictions (optional)
DDoS Protection
- AWS Shield Standard (included)
- Automatic attack detection
- Traffic scrubbing
Compute Security
Container Security
- Applications run in isolated containers
- Minimal base images
- No root access
- Regular security updates
Secrets Management
- AWS Secrets Manager for credentials
- Environment variables for configuration
- No secrets in code or logs
- Automatic rotation where possible
Database Security
PostgreSQL (AWS RDS)
- Private subnet only (no public access)
- Encrypted storage and connections
- Automated backups
- Point-in-time recovery
Access Control
- IAM-based authentication
- Separate credentials per service
- Read replicas for high availability
Storage Security
Document Storage (S3)
- Server-side encryption (AES-256)
- Versioning enabled
- Access logging
- Cross-region replication for backups
Bucket Policies
- Public access blocked
- Presigned URLs for downloads
- Time-limited access
Monitoring & Logging
What We Log
- All API requests
- Authentication events
- Security events
- Error conditions
Log Security
- Encrypted in CloudWatch
- Retained for 90 days
- Immutable (append-only)
- SIEM integration
Alerting
Real-time alerts for:
- Security incidents
- Unusual activity patterns
- System errors
- Performance issues
Backup & Recovery
Backup Schedule
| Data | Frequency | Retention |
|---|---|---|
| Database | Daily | 30 days |
| Documents | Real-time replication | Indefinite |
| Configuration | On change | 90 days |
Disaster Recovery
- RTO (Recovery Time Objective): 4 hours
- RPO (Recovery Point Objective): 1 hour
- Regular DR testing
- Documented runbooks
Learn more about backup and recovery →
Vulnerability Management
Scanning
- Automated vulnerability scanning (weekly)
- Dependency scanning in CI/CD
- Container image scanning
- Infrastructure scanning
Patching
- Critical patches: Within 24 hours
- High severity: Within 7 days
- Medium/Low: Within 30 days
Penetration Testing
- Annual third-party penetration tests
- Remediation tracking
- Re-testing of findings
- Executive summary available on request
Physical Security
AWS data centres provide:
- 24/7 security personnel
- Biometric access controls
- Video surveillance
- Environmental controls
We don't operate our own data centres.
Compliance
Our infrastructure meets requirements for:
- Cyber Essentials Plus
- GDPR
- SOC 2 Type II (in progress)