> For the complete documentation index, see [llms.txt](https://canary-1.gitbook.io/canary/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://canary-1.gitbook.io/canary/how-it-works/operational-security.md).

# Operational security

The infrastructure baseline underneath the cryptography.

The enclave guarantees what runs. The platform around it is hardened to the same standard, on the same principle as everywhere else in the stack, which is that no single credential, path or person is enough.

## Network isolation

Canary runs a custom VPC with public and private subnets rather than a default network. Critical components sit in private subnets without public IP addresses, and only load balancers are exposed. Firewall rules block all access to the servers, including SSH, except designated service traffic. A web application firewall and DDoS protection are active in front of everything.

## Detection and audit trail

Every action on the cloud account, through the console or the API, is logged. Intelligent threat detection runs continuously on the account, and the infrastructure is continuously scanned by independent security tooling.

## Credential discipline

There are no long-lived credentials. Engineers sign in through SSO with limited-duration sessions and mandatory two-factor authentication. Sensitive data is encrypted with key management backed by hardware security modules.

## Code discipline

The DVN code was audited with zero security findings, and the latest version of the code is audited on an ongoing basis by different firms. Pull requests require approvals and signed commits. See [Audits](/canary/trust-and-transparency/audits.md).

## Incident response

Critical alerts page Canary engineers and, for Cipher and Cosigner customers, the protocol or issuer team directly. For applications managing hundreds of millions in value, response time matters as much as prevention.