The internet should only ever see your front door

Our network designs follow one principle: the internet sees exactly one thing — a hardened entry point. Everything else lives on private networks with no public address at all. A request flows from the user through the CDN/WAF, to the load balancer, and only then into the private network where your services and data live.

The unglamorous payoff: a database that has no public IP cannot be in the next credential-stuffing headline. "Unreachable" beats "unbreached" — it removes the entire category of attack instead of defending against it.

Zones limit what an attacker who gets in can reach next. Production, staging, and corporate environments are separate networks — separate accounts where the platform allows — with explicit, minimal, documented connections between them:

• A compromised staging environment cannot route to production data. Ever. This is enforced by network topology, not by policy documents.
• Service-to-service traffic is allow-listed: the invoice service can reach the database and the email queue, and nothing else.
• Third-party integrations enter through dedicated egress/ingress points with their own monitoring, so a partner compromise has a known, bounded surface.
• Backups live in a separate account entirely — outside the blast radius of even a full production compromise (see Backups & Disaster Recovery).

The shared VPN with a config file from 2019 is the most common finding in our security audits — one credential, full network access, no per-person trail. We replace it with identity-aware access:

• Engineers authenticate through your SSO with MFA (passkey-first on systems we manage) — access dies automatically when the person leaves the org.
• Authorization is per-service, per-person, per-role: a frontend developer can reach staging logs, not the production database.
• High-privilege access is time-boxed: production database sessions are requested, approved, and expire in hours.
• Every session is logged — who, what, when, from where — feeding the audit trail reviewed quarterly.

Private networks limit who can connect; service identity limits what a connection can do. Services authenticate to each other with short-lived credentials issued by the platform (workload identity / mTLS where supported), never with long-lived API keys pasted into environment variables. A leaked credential that expires in an hour is an incident; one that lives for three years is a breach.

Most teams firewall inbound traffic and let anything leave. But exfiltration is an outbound act: malware phones home, a compromised dependency ships your data out. On sensitive platforms we control egress too — services may only reach the external endpoints they are documented to need, and unexpected outbound destinations raise alerts. This is the control that turns a supply-chain compromise from a quiet leak into a loud alarm.