Infrastructure & Network Security

Last Updated: April 2026

Classification: External / Client-Facing

Contact: [email protected]

---

Hosting Environment

Toku's production infrastructure runs on DigitalOcean in United States data center regions. DigitalOcean maintains SOC 2 Type II and SOC 3 Type II certifications.

Each customer's data is logically isolated at the database level. This provides per-client data isolation, defined security boundaries, simplified audit trails, and separate access controls per customer.

---

Network Architecture

Production, staging, and development environments are segmented through network isolation. Direct database access from external networks is blocked.

All internal infrastructure access routes through Tailscale, a zero-trust VPN mesh network. Tailscale requires authenticated, authorized devices to reach production resources, and all VPN traffic is encrypted end-to-end via WireGuard.

---

Web Application Firewall & DDoS Protection

Cloudflare WAF is deployed on all application-layer traffic entering Toku's infrastructure. Cloudflare provides:

• DDoS mitigation at the network and application layers
• Bot detection and automated blocking
• Rate limiting on all endpoints
• Request filtering for known attack patterns (SQLi, XSS, CSRF)
• HSTS enforcement on all public endpoints All traffic to Toku's platform routes through Cloudflare before reaching application servers.

---

Network Segmentation

Toku enforces strict segmentation between environments:

• Production is isolated from staging and development.
• Staging mirrors production security controls but uses masked/scrubbed data.
• Development environments have production-equivalent security configurations but no connectivity to production databases.
• PII is scrubbed before any data is used in non-production environments.

---

Infrastructure Monitoring

Toku uses multiple monitoring layers to detect anomalies, performance issues, and security events:

• New Relic for systematic infrastructure monitoring, performance tracking, and alerting.
• Sentry for real-time application error tracking and exception monitoring.
• PostHog for product analytics and anomaly detection (PII is excluded from all PostHog tracking).
• Database logging with enhanced audit trails for all data access and modifications.
• Automated alerting on integration API failures or anomalous behavior.
• Drata for continuous compliance monitoring, verifying that infrastructure security controls are operating effectively in real time. All monitoring systems feed into centralized alerting with an on-call escalation policy ensuring continuous coverage.

---

Database Security

All databases use AES-256 encryption at rest, managed through the cloud provider's key management service. Direct database access from external networks is blocked at the network level. All database queries involving sensitive data are logged.

Each client's data is logically isolated at the database level. One client's queries cannot reach another client's records.

---

Key Infrastructure Controls Summary