Security and data protection
This page describes the technical and organizational measures currently implemented to protect data entrusted to VetCoreSolution and enable controlled recovery after an incident.
Measures reviewed on
Infrastructure
Hosting, separation, and encryption
Data protection relies on complementary layers, from primary storage to backups.
- Servers in France
- VetCoreSolution production servers are hosted by OVHcloud in France and run Debian.
- A dedicated database per establishment
- Each establishment has a separate PostgreSQL database within a shared and segmented application infrastructure.
- Encryption at rest
- Server volumes are encrypted with LUKS. The corresponding encryption keys are managed in a KMS, separately from the data.
- Encrypted, replicated backups
- PostgreSQL backups are managed with pgBackRest, encrypted, and stored on replicated OVHcloud object storage in France. These mechanisms aim to reduce the risk of data loss and enable controlled recovery after an incident.
- Backups and reversibility
- Backups operated by VetCoreSolution support service continuity and restoration. They are separate from data exports intended for external retention or end-of-contract reversibility.
Access
Controlled identities, permissions, and communications
Access is granted explicitly, and internal communications authenticate both endpoints.
- Centralized authentication
- Keycloak centralizes authentication and JWTs. Complete, fine-grained RBAC applies permissions based on role, establishment, and authorized action.
- mTLS for every inter-service exchange
- All communications between VetCoreSolution services use gRPC protected by mTLS. Each endpoint is authenticated with renewable certificates.
- Network closed by default
- Ports remain closed unless explicitly opened for required traffic. Nginx, UFW, and fail2ban contribute to network filtering and protection against abuse.
- Security updates
- Debian security updates are automated from a controlled list.
Delivery pipeline
The same artifact, tested and then promoted to production
The continuous integration pipeline makes controls reproducible and prevents an image other than the validated one from being promoted.
- Automated deployments
- Deployments are automated with Ansible from CI. Environments are containerized, and their images are published to a controlled Harbor registry.
- Signed, immutably identified images
- Images are signed with Cosign in CI. Their signature is checked during deployment, and each image is addressed by an immutable digest.
- Controlled promotion
- Only the exact image used and validated in staging can be promoted to production.
- Mandatory reviews and tests
- Pull requests are mandatory. Unit tests cover the backends and frontend, complemented by database and integration tests. Required checks run for every merge into the main branch.
- Tests with real, isolated dependencies
- Data tests start real ephemeral PostgreSQL and Keycloak instances, with MinIO simulating object storage and Mailpit handling test emails. Integration tests start the whole container cluster and exercise it through the APIs.
- Staging redeployed every night
- The staging environment is redeployed every night. Hundreds of Playwright end-to-end tests run there, including against Stripe’s test environment. No production data is used in staging.
Operations
Observe the service and support interoperability
Telemetry helps the team diagnose service behavior, while API contracts are published in a standard format.
- Centralized telemetry
- The backends emit telemetry through OpenTelemetry. Grafana and an internal control board help track technical signals and investigate anomalies.
- Published API contracts
- APIs expose their OpenAPI specifications as JSON to document their contracts and support interoperability.
Providers
Main service providers
VetCoreSolution relies on specialist services for identified purposes. This list makes their role visible without conflating their involvement with hosting the platform’s core.
| Provider | Role | Details |
|---|---|---|
| OVHcloud | Hosting and storage | Production servers and object storage in France; selected email or SMS traffic depending on the service used. |
| Scaleway | Communications | Delivery of selected email or SMS traffic depending on the service used. |
| Mistral AI | Artificial intelligence | AI-assisted features integrated into VetCoreSolution. |
| Stripe | Payments | Payment services; nightly staging tests use Stripe’s test environment. |
Do you have a security questionnaire?
The CoreFactor team can clarify VetCoreSolution’s technical scope and address the requirements specific to your establishment.
Scope of this overview
This page presents measures that are currently in place. It does not replace contractual commitments, SaaS data-processing documentation, or a security assessment tailored to your context.