Skip to main content
The Network Security Policy governs how botBrains segments, secures, and monitors the networks that connect its services. As a fully remote, cloud-hosted company, botBrains has no corporate office network. botBrains implements network security in our cloud providers and in the encrypted channels between our systems.
botBrains is not yet ISO 27001 certified. We are preparing our ISMS and writing these policies as part of pursuing certification, and we fully intend to get our controls attested.

Scope

This policy applies to all network paths into and between botBrains production systems, including provider virtual networks, administrative access, and the public endpoints that serve the product. Our subprocessors page lists the providers behind these networks.

Segmentation and isolation

botBrains separates its local, staging, and production environments and isolates production resources from each other by function. Application servers, background workers, and the in-memory cache run on Hetzner, and the managed database and object storage run in AWS. Multi-tenant data is logically separated by tenant ID, as described in the Secure Development Policy. Databases and internal services are never exposed to the public internet. The database and the in-memory cache are reachable only from authorized application hosts over the company VPN; object storage is a private bucket accessed over TLS with IAM-authenticated requests, delivered to end users through a CDN that reaches the bucket only via signed origin requests. Internal supporting services (website crawling, malware scanning, task monitoring) run on dedicated hosts that only the application tier can reach over the VPN, and that are isolated from each other so a compromise of one cannot move laterally to another. Only the endpoints that must be public, such as the chat widget CDN and the platform API, are internet-facing. A standalone demo preview proxy — which renders a prospect’s website with the chat widget injected for demonstrations — is internet-facing by design and therefore runs fully isolated: it has no network path to the application tier, the data tier, or any internal service, and its only outbound permission is shipping security telemetry to the SIEM. Deployments and administration follow the same model: CI/CD deploys reach the application servers exclusively over the VPN with SSH, restricted to that single path, and a dedicated management host — itself reachable only over the VPN — administers the internal service hosts. Internal analytics tooling reads the database over the VPN under the same named-account, MFA-protected access as team members. The application tier also connects outbound to a small set of external managed services: AI model providers for inference, a sandboxed execution environment, and observability platforms that receive logs, metrics, errors, and traces. These connections are always outbound-only over authenticated TLS — none of these providers can initiate a connection into the botBrains network — and every provider is EU-resident and listed on the subprocessors page. The diagram below shows how traffic flows across these tiers and where the trust boundaries sit. Public traffic reaches only the edge; the data tier and internal services are reachable only from the application tier, external services are reached outbound-only, and administrative access runs over the VPN.

Secure configuration and firewalls

Provider security groups and firewall rules restrict network access. They default to deny and permit only the ports and sources required for the service to function. botBrains reviews firewall and security-group rules when infrastructure changes and at least annually (Employees Only: Network & firewall evidence). Changes follow the Operations Security Policy.

Encryption in transit and administrative access

The Cryptography Policy defines encryption standards and key management. The Access Control Policy governs identity, multi-factor authentication, and least-privilege access for administrative connections.

Monitoring and intrusion detection

botBrains runs Wazuh for intrusion detection (IDS) and security information and event management (SIEM), centralizing security-relevant logs and monitoring them for intrusion indicators, as described in the Logging and Monitoring Policy. botBrains doesn’t currently run an active intrusion prevention system. botBrains alerts on detected anomalies and handles them through the Incident Management Policy. Firewalls, spam filtering, and virus scanning are in place across our systems. Provider-level controls add DDoS protection, load balancing, and network redundancy: Hetzner provides built-in DDoS protection for our servers, and the static website is served through a CDN with Vercel adding its own DDoS protection.

Physical network security

botBrains inherits the physical networks, cabling, and data center perimeters from AWS and Hetzner under their own ISO 27001 and SOC 2 certifications. botBrains doesn’t operate its own network hardware.

ISO 27001 mapping

This policy supports Annex A controls 8.20 (networks security), 8.21 (security of network services), 8.22 (segregation of networks), 8.23 (web filtering), and 8.9 (configuration management) as it applies to network configuration.

Review

The CISO owns this policy and reviews it at least annually and whenever a material change to our network architecture or providers occurs.