Security & Storage

Everything you need to know about security & storage. Browse curated guides, step-by-step walkthroughs, and reference material.

Smarketing Security

This document outlines the security measures implemented for Node.js/React.js application deployed on Amazon Web Services (AWS).

Our objective is to ensure the confidentiality, integrity, and availability of application data while maintaining compliance with industry standards and best practices.

Infrastructure and Deployment Security

Isolated environments are maintained for development, staging, and production to prevent data cross-contamination.
Network security is enforced using Virtual Private Clouds (VPCs), Security Groups, and Network ACLs to restrict unauthorized access.
All communication is served securely over HTTPS.
AWS Identity and Access Management (IAM) applies the principle of least privilege for all users, roles, and services.
Infrastructure as Code (IaC), defined through Terraform, ensures consistent, auditable, and repeatable deployments.

Application Security

Authentication and authorization are managed via JSON Web Tokens (JWT), ensuring secure identity management.
Passwords are never stored in plaintext.
All error messages are sanitized to prevent unintended data exposure.

Data Protection

Our database is inside a private subnet so it's not accessible from outside except for a cryptographic tunnel.
All the resources are guarded by strict policies for access.
All files stored on AWS S3 are private and protected by CORS policy.
Automated backups are performed regularly with encrypted storage and controlled access.
Data minimization and retention policies ensure only necessary information is collected and retained for as long as required.

Access Control and Operational Security

All AWS and developer accounts are protected by multi-factor authentication (MFA).
Secrets and credentials are managed securely using AWS Parameter Store and GitHub Secrets.
Logging and monitoring are enabled via AWS CloudWatch.
Access to staging and production AWS ECS clusters is limited by IP whitelist and SSH keys per environment.