SECURITY POSTURE

Built for
Controlled Access

DATAENFORCE is operated with a private administrative surface, hardened origin controls, and explicit boundaries between public marketing pages, CMS operations, partner access, and analytics.

HSTS
Enforced at the edge
UFW
Default deny incoming
2FA
Identity-protected admin flows
IP Hash
Privacy-preserving analytics

Identity and Access

  • Public website content is open, but administration is isolated behind dedicated CMS and identity controls.
  • CMS admin, analytics, and partner access are protected by authenticated routes and private services.
  • Partner access is mediated through the identity provider and session controls rather than open public endpoints.

Origin and Perimeter

  • The web application listens on localhost and is exposed only through the fronting web server.
  • SSH password login is disabled, X11 forwarding is off, and fail2ban is enabled for repeated auth attempts.
  • The host firewall allows only the required inbound ports and the app is served with TLS.

Application Protections

  • Contact, newsletter, and partner entry points use server-side validation, rate limiting, and hCaptcha where applicable.
  • Analytics ingest is token-protected and the private dashboard remains restricted to authenticated administrators.
  • Public pages include noindex directives on sensitive surfaces such as CMS and analytics.

Data Handling

  • Analytics keeps operational signals such as session timing, page paths, device metadata, and hashed IP context.
  • The platform favours UTC timestamps and structured logs to support traceability without exposing unnecessary personal data.
  • Cleanup actions in analytics are logged so administration remains auditable.

Need a
formal security briefing?

If you need a procurement-oriented summary of controls, identity boundaries, or deployment hardening, the team can provide a confidential briefing.

Request a briefing