Hosting and infrastructure

Casa Conect runs on Amazon Web Services in the European Union. The whole production environment is defined as code, so its configuration is reviewed, versioned and reproducible. Your data does not leave the EU for hosting, storage or backup.

​

Where your data lives

Some processing involves third parties, most notably AI model providers. They are listed with their purpose under Subprocessors.

​

Network

• All traffic enters through a content delivery network over HTTPS, protected by a web application firewall with managed rules against common attacks, and rate limits that are stricter on sign-in and on public share pages.
• Application servers and data stores run in a private network with no public addresses. Only the edge is reachable from the internet.
• Internal connections between services use private links inside the cloud provider’s network, not the public internet.
• Files are uploaded and downloaded through short-lived, single-purpose signed links, so they never pass through the application servers and a link cannot be reused later.
• Public share pages carry a strict content security policy, cannot be embedded in other sites, and are excluded from search engines.

​

Uploads

Every uploaded file is scanned for malware before it can be opened, and the verdict is checked again before the file is served or indexed. Inbound email is scanned for viruses and spam as well. If a scan could not run, the item is held rather than passed on. See Email security.

​

Backups and recovery

• The database is backed up continuously, with point-in-time recovery, and independently on a daily schedule, with longer-term monthly recovery points.
• File storage is versioned, so overwritten and deleted objects can be recovered.
• Backups are encrypted, and the production database is protected against accidental deletion.

Casa Conect does not currently publish formal recovery time or recovery point objectives, or an uptime SLA. If your procurement process requires them, contact us.

​

Monitoring

• Infrastructure logs are encrypted and retained for a fixed period. Alarms watch the load balancer, the database and the edge.
• Application errors are reported to an error-monitoring service with request inputs reduced to their shape. Values are never sent.
• The cloud account runs the provider’s threat detection, security benchmark checks, configuration recording and access analysis.

​

Secrets

Application secrets are held in a managed secrets service, encrypted, and delivered to services at run time. They are not stored in the code repository. Cloud access for deployments uses short-lived federated credentials, not static keys.