A dedicated AWS network in Frankfurt, a single hardened entry point, and a database no one reaches from the internet.
01Hosting
Mentornity runs in its own Amazon VPC in eu-central-1 (Frankfurt), spread over three availability zones. AWS provides the physical security of its data centres (ISO 27001, SOC 2, C5 attested); Mentornity is responsible for everything from the operating system up.
02Layers
| Layer | What runs there | Who can reach it |
|---|---|---|
| Cloudflare | DNS, CDN cache, DDoS protection | The internet |
| Edge layer | TLS termination, HTTP/2 and HTTP/3, routing for every host and white-label domain | HTTPS from the internet |
| Application tier | API, web application, scheduled jobs | The edge layer only |
| Database | Replicated database cluster across three availability zones | Allow-listed hosts only; never the public internet |
| Media servers | Video meetings (WebRTC) with TURN over TLS | Meeting participants |
03Hardening
- Security groups deny all traffic by default; each rule names its port and its source, and is defined in Terraform.
- An automated verification gate runs on every infrastructure pull request and fails it if a database or monitoring port would be opened to the world.
- The web application sends a Content Security Policy with a per-request nonce, X-Content-Type-Options, a strict Referrer-Policy and frame-ancestors restrictions.
- Public forms are protected by Cloudflare Turnstile bot checks.
- Servers are built from a single template; data volumes survive a host replacement, so a server can be rebuilt without touching its data.
04Contact
Questions about this policy, security questionnaires and Data Processing Agreement requests: privacy@mentornity.com.