# Security Summary

## Comprehensive Measures

We implement a comprehensive set of security measures to protect all users. 

#### These measures include:

* **OWASP compliance**, data encryption, and **security best practices built-in**
* **24/7 server monitoring**: Continuous oversight of server performance and availability
* **Firewall protection**: A barrier against unauthorized access and attacks
* **Advanced security modules**: Such as mod\_security and Suhosin hardening, designed to intercept malicious requests
* **Anti-malware protection**: On endpoints and servers to safeguard against malware
* **Dedicated internal Security team**: To provide expert security support
* **Internal policies and procedures**: To support information security
* **Continuous scan for vulnerabilities**: Regular checks to identify and mitigate potential issues
* **Responsible Disclosure Policy & Bug Reward Program**: Encouraging users to report security issues
* **Applied OWASP secure coding practices**: Following industry standards for coding security
* **2FA authentication**: Enabling two-factor authentication for added security
* **Database encryption**: Using secure hashing algorithms to protect sensitive data
* **Regular data backups**: Ensuring data protection and recovery in case of data loss
* **Continuous static code analysis**: Detecting potential code security issues\
  These measures are part of our commitment to providing a secure and reliable hosting environment for our users

> #### We use Contabo as our core hosting infrastructure. They are *<mark style="color:green;">**100% GREEN**</mark>*. They offer us *<mark style="color:red;">**automatic, built-in DDoS protection**</mark>* that filters malicious traffic at the network level for all our servers while our app-deployment infrastructure on top of that has *<mark style="color:red;">**our own edge WAF/CDN**</mark>* for DDoS defense, acting as a proxy to absorb any/all attacks before they reach our backend infrastructure. This WAF is hidden and is proprietary and will NOT show details when you run a scan in e.g. Web Check.

{% content-ref url="/pages/pD0nMCoibNNyguZMv5LF" %}
[Compliant LLM Gateway](/lisaiceland/platform+/subprocessors/compliant-llm-gateway.md)
{% endcontent-ref %}

## WAF

We implement an advanced web application firewall (WAF) that blocks malicious traffic like SQL injection and cross-site scripting.&#x20;

The WAF is part of its security features and is also available through our CDN.&#x20;

{% embed url="<https://arcjet.com/>" %}

#### How we implement WAF:

* **Server-level:** our web and cloud hosting use hardware firewalls and other security measures. Additionally, our servers include a built-in WAF
* **ModSecurity:** This open-source WAF is enabled by default
* **CDN:** Our CDN adds an extra layer of protection by diverting malicious requests away from the origin server

#### What the WAF protects against:

* SQL injection and cross-site scripting (XSS) attacks
* DDoS attacks
* Zero-day attacks
* Bots&#x20;

## Data integrity <a href="#h_75074b44fc" id="h_75074b44fc"></a>

* All operating systems are kept up to date, including security patches
* Database encryption with secure hashing algorithms
* Regular data backups
* Continuous static code analysis to detect potential code security issues

## Certifications <a href="#h_b021bf46be" id="h_b021bf46be"></a>

* Our hosting is ISO/IEC 27001
* As for Health Insurance Portability and Accountability Act, our hosting services provide a HIPAA-compliant environment according to our Hosting Agreement
* Our sites are TrustedSite certified
* Our sites are VirusTool certified


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://nexas-ridewiz.gitbook.io/lisaiceland/platform+/security+/secure-sites+/security-summary.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.