Network Security Policy

Field	Value
Owner	Puneet Gupta (Co-Founder)
Classification	Internal (shareable under NDA)
Version	1.0
Effective date	2026-06-11
Next review	2027-06-11

1. Purpose

Define controls protecting the network perimeter and the flow of traffic to and from the Pixis platform.

2. Perimeter controls

• Ingress traffic is fronted by an nginx reverse proxy with CrowdSec intrusion detection/prevention, running the nginx, http-cve, and base-http-scenarios collections to detect and block malicious traffic.
• Cloud-provider network firewalling controls ingress/egress at the infrastructure level.

3. Segmentation & tenant isolation

• Customer data is logically segregated using PostgreSQL Row-Level Security scoped by organization_id, plus per-request organization and JWT claim validation.
• Infrastructure network segmentation is provided by the cloud provider's networking controls.

4. Configuration management of perimeter devices

Reverse-proxy, firewall, and CrowdSec configurations are maintained as version-controlled infrastructure definitions, so changes are peer-reviewed and auditable. Periodic review of perimeter rules to remove unwanted/unauthorized access is performed. (Cadence being formalized.)

5. Remote access to production

Production access is restricted to authorized engineering personnel through the cloud provider's authenticated controls; there is no open or public administrative access to production servers.

6. Network & data-flow diagrams

Network, architecture (HLD/LLD), and data-flow diagrams are maintained to document communication paths and data flows. See the architecture-diagrams task and docs/architecture/.

Revision history

Version	Date	Author	Change	Approved by
1.0	2026-06-11	Puneet Gupta	Initial draft	Puneet Gupta (Co-Founder)