Infrastructure Security
Multi-region architecture
Praevis operates in three independent regions:
| Region | Location | Primary use |
|---|---|---|
| FRA | Frankfurt, Germany (EU) | EU/MENA traffic · Primary database |
| NYC | New York, USA | US/Americas traffic |
| LON | London, UK | UK/Western Europe traffic |
Each region is an independent deployment — separate compute, separate databases, separate Redis. There is no single point of failure. If one region goes down, the other two continue serving traffic.
Data sovereignty: Each region processes only traffic from its geographic scope. EU auction data never leaves Frankfurt. US data never leaves New York. UK data never leaves London.
Network architecture
Internet traffic
↓
Cloudflare (DDoS protection, WAF, TLS termination)
↓
DigitalOcean Load Balancer (regional)
↓
Exchange pods (private network)
↓
Redis (private network) ← → PostgreSQL (private network)Private networking: All inter-service communication (exchange → Redis, exchange → PostgreSQL) occurs on DigitalOcean’s private network — never on the public internet.
No public database access: PostgreSQL and Redis are not accessible from the public internet. Only exchange pods within the same VPC can connect.
TLS
- Version: TLS 1.3 on all public endpoints (TLS 1.2 accepted for legacy compatibility)
- Certificate: Let’s Encrypt (auto-renew), managed by Cloudflare
- HSTS: Enforced — browsers and clients must use HTTPS
- TLS 1.0/1.1: Disabled globally
All traffic between supply sources (Publishers), demand sources (DSPs), and Praevis is encrypted in transit. There are no unencrypted endpoints.
DDoS protection
- Provider: Cloudflare Enterprise
- Capacity: 100+ Tbps DDoS mitigation
- L3/L4: Automatic mitigation for volumetric attacks
- L7: Web Application Firewall (WAF) with custom rules
- Rate limiting: Cloudflare-level + application-level rate limits
Cloudflare sits in front of all public-facing endpoints (rtb.praevis.com, api.praevis.com, exchange.praevis.com).
Access control
| Level | Control |
|---|---|
| Infrastructure | SSH key-based only — password auth disabled |
| Dashboard admin | MFA enforced |
| API keys | Short-lived, rotatable, scoped to partner |
| Database | VPC-only, no public access |
| CI/CD | GitLab runners with scoped deploy keys |
Principle of least privilege: Exchange pods have read access to configuration data and write access to metrics. No pod has admin database credentials.
Data at rest
PostgreSQL and Redis data is stored on DigitalOcean managed volumes with provider-level encryption. Application-level encryption for sensitive fields (API keys stored as bcrypt hashes, never in plaintext) is enforced.
End-to-end application-level encryption (AES-256) for all stored data is on the roadmap for the enterprise tier. Current protection: provider-level disk encryption + access controls.
Security patching
- OS and dependency updates applied within 30 days of release
- Critical CVEs patched within 72 hours
- Container images rebuilt weekly from updated base images
- Penetration testing: annual (report available under NDA for enterprise)