Why self-hosted security matters
AXOIX runs on our own secured servers — not on shared cloud infrastructure where your data sits alongside thousands of other tenants. Every byte of your business data is protected by 5 active layers of defense, each operating independently so that if one layer is bypassed, four more stand in the way.
Layer 1: iptables Firewall
The first line of defense operates at the network level. Our firewall runs a default-deny policy — every port is closed by default, and only explicitly allowed services (HTTPS, SSH) are accessible. This blocks the vast majority of automated attacks before they even reach our application.
Layer 2: CrowdSec Threat Intelligence
CrowdSec is a collaborative security engine that shares threat intelligence across 100,000+ servers worldwide. When an IP address attacks any server in the network, it's automatically blocked on all participating servers — including ours. This crowdsourced defense means we benefit from the collective vigilance of the entire community.
Layer 3: ModSecurity WAF (1,432 OWASP Rules)
Our Web Application Firewall inspects every HTTP request against 1,432 rules from the OWASP Core Rule Set. SQL injection, cross-site scripting (XSS), remote file inclusion, and other application-layer attacks are detected and blocked in real-time — before they reach AXOIX's application code.
Layer 4: Fail2ban (8 Active Jails)
Fail2ban monitors authentication logs across 8 services (SSH, HTTP auth, API endpoints, etc.) and automatically bans IP addresses that show brute-force behavior. Too many failed login attempts? You're blocked for 24 hours. Repeat offenders get permanent bans.
Layer 5: Nginx Rate Limiting
Even legitimate traffic is throttled to prevent abuse. Rate limiting ensures no single IP can overwhelm the server with requests, protecting against DDoS attempts and API abuse.
Beyond the 5 layers
Additional security measures include:
- HSTS preloaded — HTTPS enforced in all major browsers, even on first visit
- SSH key-only — no password authentication, no brute-force surface
- MySQL TDE — Transparent Data Encryption on database files at rest
- AES encryption on PII fields — names, emails, phone numbers are encrypted in the database
- Encrypted binlogs — even database replication logs are encrypted
- Automatic security patching — unattended upgrades keep the OS current
- Full Content Security Policy — prevents XSS and data injection in the browser
Your business data deserves enterprise-grade protection. See all AXOIX features or start your free account today. Have security questions? Contact our team.
Comments