PR.AC-5: Network integrity

Requirement

Firewalls shall be installed and activated on all the organisation's networks. Where appropriate, the network integrity of the organisation's critical systems shall be protected by incorporating network segmentation and segregation.

Our Implementation

Network integrity is managed through cloud-provider platform controls across all 11 cloud providers. Each provider implements its own firewall, network segmentation, and DDoS protection:

• Edge security: Vercel and Cloudflare provide DDoS protection, WAF capabilities, and edge-level traffic filtering
• Database isolation: Supabase, Turso, Qdrant, and Upstash databases are not publicly exposed — access is restricted to application-layer connections only, with no direct internet-facing database ports
• Compute isolation: Modal and Trigger.dev run workloads in isolated serverless containers
• Network segmentation: Production and development environments use separate credentials, projects, and infrastructure across all providers

There are no self-managed networks, routers, or firewalls — all network-level security is delegated to the cloud platforms under their respective security certifications (SOC 2, ISO 27001).

Gaps / Planned improvements:

• No centralised network monitoring dashboard across all 11 providers (NEX-368)
• No endpoint firewall policy for team member devices (NEX-355)

Evidence

• Cloud Infrastructure