Security

Transport and perimeter includes the following measures:

• HTTPS: The platform operates exclusively over HTTPS. Unencrypted HTTP is disabled.

• TLS and load balancing: The Application Gateway handles TLS termination and load balancing. A Web Application Firewall (WAF) can be enabled with standard and custom rule sets, such as Azure Bot Manager rule sets.

• DDoS protection: An Azure DDoS protection plan can be added.

• Network security groups: Network security groups separate subnets (nodes, pods, SQL, AppGW) according to Azure best practices. Internal services are only accessible via defined APIs.

System-to-system integrations: System-to-system integrations authenticate themselves via the following methods, depending on the scenario:

• Session ID

• API keys

• JWT tokens

• OAuth2 client credentials (for modern integrations)

Rate limiting: Rate limiting is primarily implemented via infrastructure components (Application Gateway or API management). It is intentionally kept lean within the core product to maintain integration flexibility.

Secure software development life cycle (SDLC) and third-party packages are handled as follows:

• Third-party checks: Third-party dependencies (NuGet, npm) are regularly checked and updated.

• GitHub scans: GitHub scans support dependency checks and static code analysis. Container images can also be scanned.

The CIA triad relies on three key factors:

Confidentiality

• Access only via SSO or authenticated logins

• Fine-grained role and permissions model

• Encryption of all connections via TLS

Integrity

• Transactions for critical write operations

• Checksums for media files, retransmission in case of errors

• Input filtering and validation in the backend

• Versioned deployments to reproduce defined system states

Availability

• Redundant instances, automatic recovery of pods or nodes

• Backups and a DR corridor (RTO/RPO in the minutes to hours range, project-dependent)

• Monitoring and alerting

• Local player cache for content