Security by design

DDSINTEL runs on Cloudflare Workers distributed across 330+ edge locations worldwide. There are no traditional origin servers to attack — there is no shell, no long-running process, and no persistent disk at the compute layer.

All requests terminate on Cloudflare's network and are served from the nearest data center to the user. This architecture eliminates entire classes of attacks (SSH brute-force, unpatched OS CVEs, hypervisor escapes) that plague conventional VPS-based SaaS deployments.

Every byte of traffic is encrypted in transit with TLS 1.3 using modern cipher suites. Certificates are provisioned and renewed automatically via Cloudflare. HSTS is enforced with preload, and legacy TLS versions are disabled.

All persistent data is encrypted at rest with AES-256. Database connections use mutual TLS. Secrets and API keys are stored in Cloudflare Secret Store — never in code, logs, or environment files.

Every API request is authenticated via signed, scoped API keys. Every dashboard session is backed by short-lived JWT tokens with refresh rotation. Row-Level Security policies enforce tenant isolation at the database layer — not merely in application code.

Mandatory WebAuthn/passkey MFA for all operator accounts. Session privilege escalation requires re-authentication. All operator actions are immutable-logged with actor, timestamp, and change set.

Request patterns, authentication events, and data-access operations are streamed into our observability pipeline in real time. Automated rules flag anomalies — unusual geography, off-hours access, sudden query-volume spikes — and trigger tiered alerts to the on-call engineer within seconds.

Audit logs are append-only, cryptographically signed, and retained for 13 months. WAF rules mitigate common web attacks, and rate limits are tuned per endpoint to absorb volumetric abuse without degrading legitimate traffic.

All code changes pass through mandatory peer review and an automated CI pipeline that runs static analysis (Semgrep), dependency vulnerability scanning (GitHub Advanced Security / Dependabot), secrets scanning (TruffleHog), and the full test suite before merge.

Deployments are immutable, versioned, and reversible in under 60 seconds. No production access without an audited CI path; no manual edits to running services.

We collect the minimum information necessary to deliver the Services, retain it only as long as required, and document every retention window in our Privacy Policy.

No third-party advertising trackers. No cross-site behavioral profiling. Customer data is never used to train public large-language models or sold to data brokers.