Security at sarvaFeed

Cloud Security & Infrastructure

Where sarvaFeed runs and how the foundation is hardened.

The entire sarvaFeed platform is built on top of a tier-one public cloud provider, deployed across multiple availability zones in the regions you choose. Workloads automatically scale to meet demand and our cloud provider transparently brings up additional capacity when traffic increases.

Data is stored in managed database services that support point-in-time recovery, so we can roll back to a recent moment in the event of developer error or data corruption.

The cloud provider's underlying data centers carry independent certifications including SOC 1, SOC 2, ISO 27001, ISO 27017, ISO 27018, PCI DSS, and HIPAA. These attestations apply to the physical infrastructure that sarvaFeed runs on; we detail our own posture in the sections below.

Compliance & Certifications

Where we are today as an early-stage platform.

sarvaFeed is an early-stage platform. We are not yet pursuing formal third-party certifications such as SOC 2 or ISO 27001, nor do we currently claim compliance with regulatory frameworks like GDPR. We build to industry best practices today, and will publish audit reports and add regulatory programs as the company matures. Customers under NDA can request our current security questionnaire and policy summaries.

Physical Security

Controls at the data centers that host sarvaFeed.

• Our cloud provider operates purpose-built data centers with redundant power, networking, and cooling.
• Physical access is controlled by surveillance, detection systems, and other electronic means; entry to server rooms is monitored by closed-circuit television.
• Staff access requires multi-factor authentication and is granted on a time-bound, least-privilege basis.
• sarvaFeed employees do not have, and do not need, physical access to the underlying data centers.

Network & System Security

How traffic and servers are protected.

• All connections to sarvaFeed use industrial-grade TLS 1.3 with strong cipher suites.
• Customer data is encrypted at rest using AES-256. Encryption keys are managed by our cloud provider's key management service.
• Production servers run hardened, regularly patched Linux images.
• Administrative access to production systems is gated behind VPN, SSH keys, and multi-factor authentication, and is restricted to a small, named group of engineers.
• Every request to production is logged with timestamp, identity, and source IP. Logs are retained centrally for review.
• An intrusion detection system monitors continuously for known attacks and brute-force attempts, with 24x7x365 alerts for abnormal activity.
• Inbound traffic is protected by our cloud provider's DDoS mitigation.
• Encrypted automated backups, snapshots, and replicas are maintained on a regular schedule.

Application Security

How the products themselves are built and defended.

• We rely on well-known, actively maintained open-source libraries and review them before adoption.
• Every architectural change goes through an in-depth security review before it ships.
• We run continuous dependency scanning, container image scanning, and static analysis on every commit. Pre-production environments are subjected to manual assessment and dynamic scanning.
• User passwords are stored as one-way salted hashes. We enforce a minimum password length and complexity, and rate-limit login attempts to defend against brute force.
• Two-factor authentication is available for all users, and we recommend it for every administrative account.
• SAML 2.0 single sign-on for federated authentication with your identity provider is coming to the Scale plan.
• Role-based authorization controls every API call. What a user can see and do is determined by their role within each project.
• Object-level audit logs capture user activity for review and investigation.

Organizational Security

The people, devices, and processes behind the platform.

• All employees and contractors sign confidentiality agreements as a condition of engagement.
• Security training is part of onboarding and is refreshed annually.
• Company laptops and workstations are centrally managed with full-disk encryption, antivirus, and firewall enforcement.
• Access to production systems, customer data, and secrets is granted on the principle of least privilege, scoped to the specific role, and reviewed on a regular cadence.
• Production access for sensitive operations is limited to a small, named group of senior engineers.

Disaster Recovery

What happens when things go wrong.

• Web tiers are self-healing: unhealthy instances are terminated automatically and replacements are brought up in another availability zone without manual intervention.
• Our primary database runs with a synchronous standby replica in a separate availability zone. Failover is automatic and typically completes in under one minute.
• Object storage is replicated across multiple facilities by our cloud provider for durability.
• Encrypted snapshots are taken at least every 30 minutes and retained off-site according to a documented retention schedule.
• We exercise our recovery procedures periodically to verify that backups are usable and that runbooks work end-to-end.

Availability

How we keep sarvaFeed up.

• Every individual component of the platform is deployed in a high-availability configuration across multiple availability zones.
• Our target for production services is 99.9% monthly availability. As we operate at scale we will publish a public status page with real-time component health and historical uptime.
• Planned maintenance is communicated to customers in advance and scheduled to minimize impact.

Data Handling

Transparency about what we store, where, and for how long.