Infrastructure Security
Atticus Health runs on hardened cloud infrastructure with multiple layers of security — from edge protection to encrypted service communication to network-level isolation. No component is publicly exposed on the internet.
Defense in Depth
Edge Protection (Cloudflare)
All traffic to Atticus Health passes through Cloudflare before reaching our infrastructure:
- Web Application Firewall — OWASP Core Rule Set plus custom rules for healthcare-specific attack patterns
- DDoS mitigation — Always-on protection at network and application layers
- Rate limiting — Adaptive thresholds that prevent abuse without impacting legitimate traffic
- Geographic controls — Available per-tenant for organizations with geographic access requirements
No Public Attack Surface
Atticus Health infrastructure has no public IP addresses. All traffic enters through encrypted tunnels from the Cloudflare edge directly into our cluster. This eliminates an entire class of network-level attacks — there is no publicly addressable endpoint to probe or attack.
Network Isolation
- Private networking — All infrastructure runs in an isolated virtual network
- Restricted communication — Services can only communicate with explicitly authorized peers
- Private data access — Databases, caches, and storage are only reachable from within the private network
- Outbound filtering — Egress traffic is restricted to known, authorized destinations
- Zero-trust administrative access — Administrative connections to infrastructure use zero-trust network access — authenticated, authorized, and encrypted with no standing VPN
Encrypted Communication
Every network hop is encrypted:
- External → TLS 1.3 enforced at the edge
- Edge to cluster → Encrypted tunnel
- Service to service → Mutual TLS (mTLS) — both sides of every internal connection verify identity and encrypt traffic
- Service to database → TLS with certificate verification
Compute Hardening
- Minimal container images — Production images contain only what's needed to run the application, minimizing attack surface
- Non-root execution — No application runs with elevated privileges
- Immutable infrastructure — Containers are read-only at runtime; no code can be modified in place
- Resource isolation — Each service runs with defined resource boundaries, preventing one service from impacting others
Secrets Management
- Centralized vault — All secrets, certificates, and encryption keys are stored in a dedicated secrets management service
- No secrets in code — Secrets are injected at runtime, never stored in source code or container images
- Automatic rotation — Secrets are rotated on a defined schedule
- Audited access — Every secret access is logged