Skip to content
aYOUne

Network Security and Monitoring Policy

Network Security and Monitoring Policy

Organisation: tolinax UG (haftungsbeschränkt), operator of the aYOUne platform
Status: Approved by the Managing Director and published. Version 1.0, effective 2026-10-14
Owner: Managing Director
Review cycle: at least annually

1. Architecture (implemented)

  • Production runs on Google Kubernetes Engine in europe-west3 (Frankfurt, Germany). The database is a managed MongoDB Atlas cluster in the same region.
  • All inbound internet traffic enters through a single service-mesh ingress gateway (Istio). Services are not exposed individually to the internet; only explicitly routed hostnames are reachable.
  • Workload classes are separated: crawler workloads run on a dedicated, tainted node pool, isolated from API and worker workloads.
  • Real-time media and remote-support relays that need raw TCP/UDP run in their own namespaces behind dedicated load balancers.
  • Build and package infrastructure (private package registry, CI runners) is hosted separately at Hetzner in Nuremberg, Germany, and holds no customer data.

2. Protective controls (implemented)

  • HTTPS-only public endpoints; HTTP is redirected.
  • Internal metrics endpoints are blocked at the gateway for external requests.
  • IP block lists at the gateway for abusive sources.
  • Rate limiting on all APIs (Redis-backed) with stricter limits on login, second-factor, verification and PIN endpoints; account lockout after repeated failures.
  • Security headers on API responses (including HSTS).
  • Inbound webhooks are accepted only with valid provider signatures.

3. Monitoring and detection (implemented)

  • Prometheus with Alertmanager collects metrics from the cluster and services; alerts are delivered to the operations team in real time via a messaging channel.
  • Dashboards for service health and resource usage.
  • Kubernetes health and readiness probes restart unhealthy services automatically.
  • Runtime errors of every service are recorded automatically as tracked bug tasks.
  • Authentication events and API actions are logged centrally.
  • A public status page reports component status and incidents.

4. Planned improvements

  • Kubernetes network policies (default-deny between namespaces and workloads).
  • Strict mutual TLS inside the service mesh with authorisation policies (internal traffic is not yet mutually authenticated).
  • Evaluation of a web application firewall in front of the ingress gateway.

Work with this page

Ready-made instructions for your AI tool. Copy, paste, go — the AI fetches the content itself via the address in the text.

Summarise the steps for me The essentials, in the right order.
Read the following documentation by tolinax UG and work with it.

This page: https://ayoune.com/en/docs/security-privacy/network-security-and-monitoring-policy.md
The complete collection: https://ayoune.com/en/docs/security-privacy.md

Summarise the content for me.

- First, in two sentences: what is this about?
- Then the steps in the order I need to take them.
- One line per step, in plain language.
- At the end: what I should have ready beforehand.

Leave out nothing I need in order to actually finish.
A note on sources:
- Every page of this documentation is available as Markdown (the same address with `.md`).
- A machine-readable overview of all public content is at `/llms.txt`.
- If you have access to the aYOUne MCP server, you can work against live data
  instead of this snapshot. If not, ignore this point.
Explain what I need this for What it is good for — and when it is worth it.
Read the following documentation by tolinax UG and work with it.

This page: https://ayoune.com/en/docs/security-privacy/network-security-and-monitoring-policy.md
The complete collection: https://ayoune.com/en/docs/security-privacy.md

Explain to me what I need this for.

1. Which problem does it solve? In one sentence, from my point of view.
2. Three typical situations in which it genuinely helps me.
3. When I do NOT need it — that saves me time.
4. What I can do instead if it is not a fit.

Stick to what the source says. Where it gives nothing, say so openly instead
of guessing.
A note on sources:
- Every page of this documentation is available as Markdown (the same address with `.md`).
- A machine-readable overview of all public content is at `/llms.txt`.
- If you have access to the aYOUne MCP server, you can work against live data
  instead of this snapshot. If not, ignore this point.
Help me set this up Step by step, asking me as you go.
Read the following documentation by tolinax UG and work with it.

This page: https://ayoune.com/en/docs/security-privacy/network-security-and-monitoring-policy.md
The complete collection: https://ayoune.com/en/docs/security-privacy.md

Walk me through the setup step by step.

- First tell me what I need to have ready (access, data, time).
- Then take me through ONE step at a time. Wait for my "next".
- For each step, say how I can tell that it worked.
- If something goes wrong, ask me for the exact message instead of guessing.

If the instructions leave a point open, tell me so rather than inventing it.
A note on sources:
- Every page of this documentation is available as Markdown (the same address with `.md`).
- A machine-readable overview of all public content is at `/llms.txt`.
- If you have access to the aYOUne MCP server, you can work against live data
  instead of this snapshot. If not, ignore this point.
Help me with a problem Narrow down the cause instead of guessing.
Read the following documentation by tolinax UG and work with it.

This page: https://ayoune.com/en/docs/security-privacy/network-security-and-monitoring-policy.md
The complete collection: https://ayoune.com/en/docs/security-privacy.md

Help me narrow down a problem.

- First ask me what I observe and what I expected instead.
- From that, derive the most likely causes consistent with this source.
- For each cause, give me ONE test that confirms or rules it out.
- Order them so the cheapest test comes first.

Do not guess. If the source does not cover the problem, tell me where I should
look next.
A note on sources:
- Every page of this documentation is available as Markdown (the same address with `.md`).
- A machine-readable overview of all public content is at `/llms.txt`.
- If you have access to the aYOUne MCP server, you can work against live data
  instead of this snapshot. If not, ignore this point.
Explain it in plain words No jargon, from the ground up.
Read the following documentation by tolinax UG and work with it.

This page: https://ayoune.com/en/docs/security-privacy/network-security-and-monitoring-policy.md
The complete collection: https://ayoune.com/en/docs/security-privacy.md

Explain the content so that someone without prior knowledge understands it.

- Start with the purpose: why does this exist at all?
- Explain technical terms in half a sentence on first use.
- One everyday comparison where it genuinely holds — none where it limps.
- At the end: the three things worth remembering.

Do not shorten by dropping conditions. A simplification that hides a
prerequisite is a false statement.
A note on sources:
- Every page of this documentation is available as Markdown (the same address with `.md`).
- A machine-readable overview of all public content is at `/llms.txt`.
- If you have access to the aYOUne MCP server, you can work against live data
  instead of this snapshot. If not, ignore this point.
A checklist to tick off To follow along while you do it.
Read the following documentation by tolinax UG and work with it.

This page: https://ayoune.com/en/docs/security-privacy/network-security-and-monitoring-policy.md
The complete collection: https://ayoune.com/en/docs/security-privacy.md

Turn this into a **tick-off checklist** for practical use.

- Exactly one action per item, in the imperative.
- Order it so that no item depends on a later prerequisite.
- Prerequisites and pitfalls as indented sub-items.
- End with an acceptance step: how do I know everything is right?
A note on sources:
- Every page of this documentation is available as Markdown (the same address with `.md`).
- A machine-readable overview of all public content is at `/llms.txt`.
- If you have access to the aYOUne MCP server, you can work against live data
  instead of this snapshot. If not, ignore this point.

Was this article helpful?

👎 No (0)
Leave a comment