Scope
This policy applies to all network paths into and between botBrains production systems, including provider virtual networks, administrative access, and the public endpoints that serve the product. Our subprocessors page lists the providers behind these networks.Segmentation and isolation
botBrains separates its local, staging, and production environments and isolates production resources from each other by function. Application servers, background workers, and the in-memory cache run on Hetzner, and the managed database and object storage run in AWS. Multi-tenant data is logically separated by tenant ID, as described in the Secure Development Policy. Databases and internal services are never exposed to the public internet. The database and the in-memory cache are reachable only from authorized application hosts over the company VPN; object storage is a private bucket accessed over TLS with IAM-authenticated requests, delivered to end users through a CDN that reaches the bucket only via signed origin requests. Internal supporting services (website crawling, malware scanning, task monitoring) run on dedicated hosts that only the application tier can reach over the VPN, and that are isolated from each other so a compromise of one cannot move laterally to another. Only the endpoints that must be public, such as the chat widget CDN and the platform API, are internet-facing. A standalone demo preview proxy — which renders a prospect’s website with the chat widget injected for demonstrations — is internet-facing by design and therefore runs fully isolated: it has no network path to the application tier, the data tier, or any internal service, and its only outbound permission is shipping security telemetry to the SIEM. Deployments and administration follow the same model: CI/CD deploys reach the application servers exclusively over the VPN with SSH, restricted to that single path, and a dedicated management host — itself reachable only over the VPN — administers the internal service hosts. Internal analytics tooling reads the database over the VPN under the same named-account, MFA-protected access as team members. The application tier also connects outbound to a small set of external managed services: AI model providers for inference, a sandboxed execution environment, and observability platforms that receive logs, metrics, errors, and traces. These connections are always outbound-only over authenticated TLS — none of these providers can initiate a connection into the botBrains network — and every provider is EU-resident and listed on the subprocessors page. The diagram below shows how traffic flows across these tiers and where the trust boundaries sit. Public traffic reaches only the edge; the data tier and internal services are reachable only from the application tier, external services are reached outbound-only, and administrative access runs over the VPN.Secure configuration and firewalls
Provider security groups and firewall rules restrict network access. They default to deny and permit only the ports and sources required for the service to function. botBrains reviews firewall and security-group rules when infrastructure changes and at least annually (Employees Only: Network & firewall evidence). Changes follow the Operations Security Policy.Encryption in transit and administrative access
The Cryptography Policy defines encryption standards and key management. The Access Control Policy governs identity, multi-factor authentication, and least-privilege access for administrative connections.