Security policy

1. Technical safeguards

Encryption and transport

• TLS 1.2+ enforced for all public endpoints. TLS 1.0/1.1 disabled.
• HSTS preload with max-age=31536000, includeSubDomains, preload.
• Encryption at rest for customer databases (AES-256). Backups encrypted.
• Cloudflare in front of every public application — DDoS shield, WAF, edge encryption.

Network architecture

• Customer environments are physically separated (VLAN/VPC + firewall rules)
• VPN-only access (WireGuard / IPsec) to admin panels and SSH
• Public access only through a load balancer / reverse proxy
• No direct traffic from the internet to databases

System hardening

• Security patches — Oracle CPU (Critical Patch Update) quarterly, IBM Security Bulletin on an ongoing basis
• CIS Benchmarks alignment for Linux and WebSphere/WebLogic systems
• Vulnerability scans every 30 days (OpenVAS / tools dedicated per technology)
• Production hosts without unnecessary services, minimal install

2. Access management

Authentication & authorization

• MFA required for all administrative accounts (TOTP / hardware keys)
• Strong password policy: bcrypt / Argon2 hashing on the application side
• RBAC (Role-Based Access Control) — principle of least privilege at every level
• No shared accounts — every admin has individual credentials

Audit logs

• All administrative operations are logged (who, what, when, from which IP)
• Logs retained 90 days online + 12 months in cold-storage archive
• Tamper-evident — log integrity check (hash chain)
• Access to logs restricted to the "auditor" role

3. Compliance and standards

Enterprise customers (T-Mobile, PZU, BASF, Samsung) are subject to additional contractual requirements. Individual SLAs, DPAs and security questionnaires are prepared on request.

4. Operational processes

24/7 monitoring

• Dedicated on-call engineer — a phone line, not a ticket in a queue
• Uptime monitoring (Uptime Kuma + dedicated probes on customer health endpoints)
• Alerting via SMS + email + Slack/Teams (the customer chooses the channel)
• Escalation: L1 (15 min) → L2 (30 min) → CEO (60 min)

Backup and recovery

• Daily backup with 30-day rolling retention + 12-month archive
• 3-2-1 rule: 3 copies, 2 media types, 1 off-site
• RTO < 15 minutes for enterprise production environments (with a 24/7 contract)
• RPO < 1 hour with continuous DB replication
• Restore test every quarter (drill exercise)

5. Security breaches

Procedure compliant with GDPR Art. 33–34:

6. Audits and tests

• Penetration tests — annual, by an external firm specialising in web/API application security
• Vulnerability scans — every 30 days (OpenVAS, Nessus for enterprise customers)
• Code review — peer review for every change to production code
• Tabletop exercises — incident simulations every 6 months
• Compliance audits — internal quarterly, external on customer request

7. Responsible disclosure

If you discover a vulnerability in our infrastructure or services, do not disclose it publicly before reporting it to us. We work constructively with security researchers.

Contact

• Email: [email protected] — subject [SECURITY]
• Phone: +48 606 464 264 (for critical incidents — 24/7)
• PGP key fingerprint: on request

Scope

• In scope: FlexNet infrastructure (flexnet.pl, new.flexnet.pl, dev.flexnet.pl), applications we host, customer environments (after coordination with the customer)
• Out of scope: third-party services (Cloudflare, Google Fonts), social engineering of our staff, DoS / DDoS

Rules

• Do not exploit a vulnerability beyond a proof of concept
• Do not access customers' personal data or modify data
• Give us a reasonable time to fix (typically 90 days from the report)
• After the fix — we allow publication (with prior coordination around the CVE / description)

8. Contact