e
evanly
Security & Infrastructure Overview
by Evanly, LLC

Built responsibly, from the first line of infrastructure.

evanly runs entirely on Amazon Web Services in the US (Oregon region), on an audit-ready security baseline defined as version-controlled infrastructure-as-code. Every control below is live in the account today and independently verifiable in the AWS console.

Controls verified live · 22 Jul 2026 · AWS account 922085930589 · us-west-2
At a glance

Prevent

  • AWS WAF on all public endpoints — managed rule sets + rate limiting
  • HTTPS enforced everywhere, TLS 1.2 minimum
  • Storage origins private — reachable only via the CDN
  • Encryption at rest across storage & state

Detect

  • GuardDuty continuous threat detection
  • Security Hub scoring vs. AWS & CIS benchmarks
  • IAM Access Analyzer for external-access exposure
  • High-severity findings routed to a monitored inbox

Record

  • CloudTrail — multi-region, tamper-evident audit log
  • AWS Config — continuous configuration history
  • Versioned, encrypted, private log storage
  • Least-privilege IAM, MFA-enforced admin access

Govern

  • 100% infrastructure-as-code (Terraform), peer-reviewable
  • CI deploys via short-lived OIDC — no long-lived keys
  • Account-wide public-access block on storage
  • Budget & cost-anomaly alerting
Controls in detail
Hosting & residencyAmazon Web Services, US-West-2 (Oregon). Data origin stays in-region; global content delivery via CloudFront edge network.Live
Edge protectionAWS WAF on every public distribution — Amazon IP-reputation, common-attack, and known-bad-input rule sets, plus per-IP rate limiting.Live
Transport securityHTTPS enforced with automatic HTTP→HTTPS redirect; TLS 1.2 minimum; certificates managed and auto-renewed by AWS.Live
Encryption at restServer-side encryption on all storage; KMS-managed keys for infrastructure state and audit logs; default EBS volume encryption account-wide.Live
Identity & accessMFA-enforced administrative access, least-privilege IAM, strict password policy. CI/CD authenticates via short-lived GitHub OIDC tokens — no static credentials stored.Live
Threat detectionAmazon GuardDuty analyzes account, network, and API activity continuously; high-severity findings are auto-routed to a monitored inbox.Live
Audit loggingAWS CloudTrail multi-region trail with log-file validation, delivered to versioned, private, encrypted storage. AWS Config records full configuration history.Live
Compliance scoringAWS Security Hub continuously scores the account against the AWS Foundational Security Best Practices and CIS AWS Foundations benchmarks.Baseline establishing
Email securityMicrosoft 365 (enterprise) with SPF, DKIM, and DMARC configured for the sending domain.Live
How customer data is handled

Today: no customer data at risk

The public product experience is a self-contained demonstration served from static storage with synthetic sample data. It has no live database, no customer records, and no personally identifiable information behind it — there is simply nothing sensitive to expose at this stage.

By design: isolation per customer

The production architecture provisions a dedicated, isolated stack per customer — separate database, storage, and authentication — rather than pooling tenants in shared tables. Each customer's data is walled off at the infrastructure boundary.

On the roadmap to production
PlannedManaged authentication (Amazon Cognito) — hosted identity, MFA, and session management, deployed alongside the production application backend.
PlannedPer-tenant production stacks — isolated database, storage, and API per customer, provisioned as code.
PlannedDMARC enforcement — tighten the email policy from monitoring to active rejection as sending volume matures.
OngoingSecurity Hub remediation — track the benchmark score to target and resolve findings as the platform grows.