Security first. Operated continuously.

The data center is only the first security boundary.

AethDesign-operated deployments use selected Hetzner locations in Germany when the product requirements allow it. Hetzner is responsible for the physical data center and provider layer. AethDesign remains responsible for the server configuration, operating system, application, identities, secrets, data flows, updates, monitoring, and recovery process.

Security is maintained through the complete stack. A dedicated frontier-model agent regularly reviews the AethDesign-operated server structure and codebases, including exposed services, deployment configuration, dependencies, access paths, secrets handling, and data flows. Findings are reproduced and verified by a human before they become controlled fixes.

What security-first operation includes

Layers selected to reduce exposure.

Infrastructure and edge

German hosting with a smaller public surface: Hetzner Cloud, Linux, Docker, Nginx, TLS, Firewalls.

Identity and data

Access and storage that can be explained: SSH keys, Least privilege, MFA, Secret rotation, Database permissions, Retention rules.

Recovery and signals

Evidence for action and restoration: Health checks, Structured logs, Error tracking, Backups, Restore tests, Rollback plans.

Security review

Scheduled full-estate coverage: AI security agent, Server inventory, Codebase review, Dependency review, Configuration review, Attack-path analysis.

Security is reviewed as the product changes.

The operating process connects prevention, detection, recovery, and evidence. New features and infrastructure changes re-enter the same review loop.

1. Harden: Threat-model valuable data and entry points, then reduce public services, permissions, credentials, packages, retention, and implicit trust.
2. Verify: Run the scheduled AI agent across the complete server structure and codebase, reproduce credible findings, remove false positives, and prioritize verified risk.
3. Release: Deploy through controlled changes with environment separation, health checks, migration planning, rollback paths, and no secrets committed to source.
4. Operate: Monitor the system, review dependencies and configuration, test recovery, revisit access, document incidents, and keep the full-estate audit running on schedule and after meaningful changes.

Typical deliverables

• Hosting and trust-boundary architecture
• Hardened server and reverse-proxy configuration
• Identity, permission, and secret-handling plan
• Backup, restore, and rollback process
• Monitoring and alerting setup
• Verified full-server and code audit findings

Standards and infrastructure references.

The operating approach is informed by primary provider documentation and established security-verification guidance. Referencing a standard does not mean a project is certified against it.

• Hetzner data centers and connections: Official location, facility, power, and network information for Hetzner data center parks, including Nuremberg and Falkenstein in Germany.
• Hetzner technical and organizational measures: Provider-side physical, organizational, network, and data-protection measures, including the customer responsibility for self-managed server security.
• OWASP Application Security Verification Standard: An open basis for verifying web application security controls and defining the expected depth of technical security review.
• BSI IS audits based on IT-Grundschutz: German federal guidance describing recurring information-security review as part of maintaining and improving an appropriate security level.

Questions and answers

Does high-security hosting mean a system cannot be breached?

No. No responsible provider can guarantee that. The goal is to reduce avoidable exposure, make important controls explicit, detect meaningful failures earlier, recover deliberately, and keep improving as the product and threat landscape change.

Are all projects hosted on servers in Germany?

AethDesign-operated deployments use selected German Hetzner locations by default when the product requirements allow it. External services such as email, payments, analytics, AI providers, or customer-selected infrastructure can create additional data locations that must be documented separately.

What does the scheduled AI security agent audit?

The audit boundary is the complete AethDesign-operated server structure and its codebases. It reviews topology, exposed services, deployment configuration, dependencies, access paths, secret handling, data flows, and changes. Secrets are excluded or redacted, and every finding still needs human verification and a controlled fix.

Do model-assisted audits replace penetration testing?

No. They add frequent review coverage between releases and can find issues early. Independent penetration testing, specialist review, and formal certification remain separate measures for products whose risk, regulation, customers, or procurement requirements justify them.