Infrastructure and monitoring
Defera runs on established cloud platforms, with protections built in at every layer and automated checks running around the clock. An automated security sweep checks our site and services every six hours and alerts our team to anything critical.
Where Defera runs
- Cloud hosting. Our website and API run on a major cloud hosting platform, served only over HTTPS.
- Managed database. Our database, sign-in and file storage run on a managed database platform in the western United States, encrypted at rest and backed up every day.
- Payment processors. Card payments run through certified payment processors, so card numbers never pass through our own servers.
Protections built in
- HTTPS and HSTS on every page and every request.
- Browser protections. Our pages tell browsers not to let other websites show them inside a frame, which blocks clickjacking tricks, and not to guess at file types.
- Rate limits. Our API, flight search and chat limit how many requests can be made in a short time, which slows down automated abuse.
- Signed payment messages. Messages from our payment processors are checked for a valid signature before we act on them.
- Private by default. Account pages, internal tools and private data turn away anyone who isn't signed in with the right access.
Automated checks, around the clock
Silas, our SI for security and reliability, runs an automated security sweep every six hours. Each run checks that:
- our site and services are up and loading correctly;
- our site sends the security headers it should;
- private pages and internal tools turn away anyone who isn't signed in;
- our database refuses anonymous requests for private data;
- the settings our security depends on are in place;
- our security certificate is valid and nowhere near expiring.
A new critical finding alerts our team the moment it's found. Every scheduled job, from payment reminders to reports, also checks in each time it runs, and an hourly audit watches our payment operations and those check-ins.
Testing and change control
- Automated tests. Thousands of automated tests cover our payment logic and access checks.
- Version control. Every change to Defera's code is tracked in version control, so we always know what changed, when and why.
When something goes wrong
When a check fails or someone reports a problem, we investigate, contain it, fix the cause and add checks so it doesn't happen again. If an incident affects your personal information, we'll notify you as the law requires. To report a security issue, see Reporting a vulnerability.