Dedicated hardware
Aureus clusters run on dedicated bare metal servers. There are no co-tenants on your hardware. Network isolation at the physical layer is complete — no other customers' traffic traverses your NIC.
Kubernetes network policies
Within your cluster, Kubernetes Network Policies restrict pod-to-pod traffic. Services only communicate with what they're explicitly allowed to. By default, pods cannot reach each other unless a policy permits it.
Private networking
Your internal services communicate over a private network interface that is not accessible from the public internet. Database services, queue workers, and internal APIs are never exposed publicly — only through your designated ingress points.
Ingress and egress
All inbound public traffic goes through the Kubernetes ingress controller, which applies TLS termination, rate limiting, and header validation before requests reach your application. Outbound traffic from pods is routed through a NAT gateway with a stable IP — useful for allowlisting with third-party APIs.
DDoS mitigation
Our upstream network provider applies volumetric DDoS mitigation at the network edge. For application-layer protection, rate limiting is configured at the ingress level and tunable based on your traffic patterns.
Firewall
Host-level firewall rules allow only the ports required for cluster operation and your declared services. SSH access to nodes is restricted to Aureus infrastructure team IPs and is fully audited.