<li><strong>Encryption in Transit:</strong> All communications are secured via TLS with modern cipher suites.</li><li><strong>Encryption at Rest:</strong> Sensitive data is encrypted using authenticated encryption with per-record nonces via libsodium.</li><li><strong>Network Isolation:</strong> Our infrastructure operates across isolated VPS nodes with strict firewall rules and SELinux enforcement.</li><li><strong>Authentication:</strong> Sessions use secure, HTTP-only, same-site cookies with CSRF protection on all state-changing operations.</li><li><strong>Rate Limiting:</strong> Login and API endpoints are rate-limited to prevent brute-force attacks.</li><li><strong>Content Security Policy:</strong> Strict CSP headers prevent cross-site scripting and injection attacks.</li>