Information Security

Esparcidor operates a strict zero‑trust model: no user, device, or network is inherently trusted. Every access request is authenticated, authorized, and encrypted, regardless of origin. This applies equally to internal engineering nodes and consortium partner dashboards.

Our network is segmented into isolated virtual private clouds (VPCs) with micro‑segmentation policies that prevent lateral movement. Production environments are physically and logically separated from development and staging.

Access is granted via multi‑factor authentication (MFA) enforced at the organizational level. We employ hardware security keys (FIDO2/WebAuthn) for all administrative accounts. Partner access is provisioned with least‑privilege principles: a partner can see only their own cohort's data and resources.

All authentication events are logged immutably and monitored for anomalies. Failed attempts, unusual geographic patterns, and privilege escalations trigger real‑time alerts to our security operations node.

Data at rest is encrypted with AES‑256 (GCM mode). Data in transit uses TLS 1.3 exclusively; older protocols are disabled at the edge. For sensitive inter‑node communication, we layer mutual TLS (mTLS) with short‑lived certificates.

Encryption keys are managed via a dedicated hardware security module (HSM) and rotated on a defined schedule. No human operator has direct access to raw key material.

All production systems run on immutable infrastructure. Server instances are replaced, not patched. Containers are scanned for vulnerabilities before deployment, and runtime behavior is continuously validated against a defined security policy.

Network traffic is inspected at the application layer via a Web Application Firewall (WAF) tuned to OWASP Top 10 threats. DDoS mitigation is handled at the edge by our CDN, with automatic failover across geographic nodes.

We maintain a documented incident response plan tested bi‑annually. Detection SLAs, containment procedures, and partner notification timelines are predefined. All critical events are reported to affected parties within 24 hours of confirmation.

Independent third‑party penetration tests are conducted annually. Results (sanitized) are available to consortium partners under NDA. Our security posture is reviewed quarterly by the governance team, and improvements are implemented continuously.