evanly runs entirely on Amazon Web Services in the US (Oregon region), on an audit-ready security baseline defined as version-controlled infrastructure-as-code. Every control below is live in the account today and independently verifiable in the AWS console.
| Hosting & residency | Amazon Web Services, US-West-2 (Oregon). Data origin stays in-region; global content delivery via CloudFront edge network. | Live |
| Edge protection | AWS WAF on every public distribution — Amazon IP-reputation, common-attack, and known-bad-input rule sets, plus per-IP rate limiting. | Live |
| Transport security | HTTPS enforced with automatic HTTP→HTTPS redirect; TLS 1.2 minimum; certificates managed and auto-renewed by AWS. | Live |
| Encryption at rest | Server-side encryption on all storage; KMS-managed keys for infrastructure state and audit logs; default EBS volume encryption account-wide. | Live |
| Identity & access | MFA-enforced administrative access, least-privilege IAM, strict password policy. CI/CD authenticates via short-lived GitHub OIDC tokens — no static credentials stored. | Live |
| Threat detection | Amazon GuardDuty analyzes account, network, and API activity continuously; high-severity findings are auto-routed to a monitored inbox. | Live |
| Audit logging | AWS CloudTrail multi-region trail with log-file validation, delivered to versioned, private, encrypted storage. AWS Config records full configuration history. | Live |
| Compliance scoring | AWS Security Hub continuously scores the account against the AWS Foundational Security Best Practices and CIS AWS Foundations benchmarks. | Baseline establishing |
| Email security | Microsoft 365 (enterprise) with SPF, DKIM, and DMARC configured for the sending domain. | Live |
The public product experience is a self-contained demonstration served from static storage with synthetic sample data. It has no live database, no customer records, and no personally identifiable information behind it — there is simply nothing sensitive to expose at this stage.
The production architecture provisions a dedicated, isolated stack per customer — separate database, storage, and authentication — rather than pooling tenants in shared tables. Each customer's data is walled off at the infrastructure boundary.