Compliance, security, and governance

Protegon is built for repeatable audits of your own internet-exposed assets.

It is not permission to test third-party systems. Unauthorized scanning may be illegal and is prohibited by our Terms and policy.

• Only scan targets you control, or where you have explicit written authorization.
• Stay within agreed scope (hostnames, environments, and time windows).

Our platform runs on Amazon Web Services (AWS), chosen for resilience and its ability to operate critical services at scale.

The architecture is designed for high availability, with redundancy for essential components and recovery mechanisms after incidents.

Production data is hosted in regions located in the European Union to support data sovereignty and GDPR-aligned requirements.

Traffic between users, APIs, and internal services is protected in transit using TLS 1.2/1.3.

Data at rest is encrypted using industry-standard algorithms (AES-256) to reduce risk from unauthorized physical or logical access.

Cryptographic key management is centralized in AWS KMS with strict access policies and usage auditing.

Permissions follow least privilege: each identity only receives the rights required for its role.

Sensitive access is strengthened with strong authentication (MFA), including for administrative accounts.

Identity and authorization are governed with AWS IAM, with separation of technical and operational roles.

• Logging of administrative actions and privileged access.
• Audit capabilities to review changes and security-relevant events.

We rely on the AWS compliance framework, including ISO 27001, ISO 27017, ISO 27018, and SOC 1, SOC 2, and SOC 3 reports.

These frameworks demonstrate sound practices for cloud operations governance, security, and data protection.

Our approach also incorporates GDPR principles, including data minimization, transparency, and securing processing activities.

Critical data is backed up automatically, with retention policies aligned to the expected service level.

A disaster recovery plan defines how essential functions are restored within controlled timeframes.

Periodic tests validate restoration and recovery procedures.

The platform is monitored continuously with real-time tooling for availability, performance, and application errors.

Anomaly detection helps identify unusual behavior quickly and trigger the right investigations.

Incidents follow a formal process covering triage, resolution, communication, and lessons learned.

We maintain strict separation of environments (development, test, production) to limit error propagation or inappropriate access.

Application and system components are updated regularly to address known vulnerabilities.

• Security audits and penetration testing commensurate with risk.
• Ongoing awareness for teams on cyber and compliance topics.