Security

Operational security over checkbox compliance

For us, security is daily operational work. We rely on clear standards, disciplined processes, and consistent execution.

Our operational practice

• Update cadence: We schedule updates at least weekly.
• Critical CVEs: For critical vulnerabilities, we prioritize mitigation with a target of implementing measures within hours.
• Continuous monitoring: We monitor security-relevant events and platform stability continuously.
• System hardening: We harden systems and configurations based on proven best practices.
• Least privilege & defense in depth: We consistently apply foundational security principles to limit blast radius in case of incidents.
• Encryption in transit and at rest: Where feasible, we apply transport encryption (for example TLS) and encrypted data storage.
• State-of-the-art cryptography: We use established cryptographic methods aligned with current industry practice.
• Key and secret management: We handle keys and secrets with restrictive access controls and defined rotation and handling processes.
• Automation & infrastructure as code: We implement changes in a traceable and reproducible way.
• Minimal manual intervention: We keep manual interventions to a sensible minimum to reduce configuration mistakes and operational risk.
• Traceable logging: We keep security-relevant events traceably logged and reviewable.
• Automated protections: We use automated protection mechanisms to limit risk early.

Sovereignty and transparency

Security is only sustainable when you keep control. That is why we work with clear guardrails, traceable decisions, and no artificial lock-in barriers.

GDPR and EU operation

EU operation and GDPR-compliant processes are our baseline. They are an important trust component, but not the only one.

TOM and evidence

Detailed technical and organizational measures (TOM) are provided in the appropriate contractual and security context.

Next step

If you want to make your infrastructure more resilient, talk to us.

Security requests: soc@soluforge.de

For encrypted communication, our public PGP key is available for download:

• Download PGP key