Security and infrastructure

Summary

• LingoQuesto is a cloud service (SaaS) that the institution uses from the browser. Nothing is installed on its infrastructure.
• The entire platform is hosted in the United States, on managed services from DigitalOcean, AWS and Microsoft Azure.
• Communication is encrypted in transit and data is stored encrypted at rest.
• Each institution sees only its own information. Separation between institutions is logical, on shared infrastructure.
• The test and production environments are separate.

Hosting

Component	Provider and service	Location
Web application	AWS Amplify, distributed with CloudFront	United States (us-east-1)
API, AI services and real time	DigitalOcean Kubernetes	New York (NYC3), United States
Database	DigitalOcean Managed PostgreSQL	New York (NYC3), United States
Files: audio, images and documents	DigitalOcean Spaces	New York (NYC3), United States
Cache and job queues	DigitalOcean Managed Caching	New York (NYC3), United States
DNS and edge protection	Cloudflare	Global network
Credentials and secrets	Microsoft Azure Key Vault	—

All production infrastructure runs in a single region. There is currently no alternative hosting option in another country.

Network

• The production cluster, the database and the cache are in a private network (VPC) dedicated to the environment.
• The database and the cache only accept connections from the production cluster and from expressly authorized addresses.
• Internet traffic comes in through a single load balancer, always over HTTPS.
• The web application and the API are published through Cloudflare, which provides denial-of-service attack mitigation and filtering of malicious traffic.

Environments

Test (QA) and production are independent environments. Each one has its own cluster, private network, database, cache, file storage and secret vaults.

Changes are validated in the test environment before being released to production. Urgent fixes are reviewed and released directly.

Encryption

Where	How
In transit	HTTPS and secure WebSocket with TLS 1.2 or higher. HTTP requests are redirected to HTTPS and the domains send HSTS.
Database	Encrypted at rest by the managed service.
Files	Encrypted at rest with AES-256 by the storage service.
Backups	Encrypted by the managed database service.
Passwords	Never stored as text. Only a salted hash is stored (PBKDF2 with SHA-256).

Access control

• Roles. Four fixed roles: student, teacher, coordinator and institutional administrator. The role is assigned per campus and defines what each person sees and can do.
• Separation between institutions. Each request is validated against the user’s active membership in the campus. One institution’s data is not visible to another.
• Sessions. The API requires authentication by default. Sessions use short-lived tokens that are renewed and revoked.
• Rate limiting. The API limits the number of requests per user and per IP address.
• Sign-in. With the institutional Microsoft or Google account, from the LMS through LTI 1.3, or with email and password. See LMS integration and institutional sign-in.
• Second factor. When the user signs in with their Microsoft or Google account, or from the LMS, the institution’s second factor and access policies apply. LingoQuesto doesn’t manage its own second factor.
• Access log. Each sign-in is logged with the date, method, IP address and browser.

Secrets management

Production credentials are stored in Azure Key Vault, separated by service and by environment. They are not part of the source code and reach the services at deployment time.

Availability

• The application services run with multiple replicas, spread across different nodes, and scale automatically with load.
• Updates are rolled out gradually, without stopping the service.
• The database is a managed service with automatic backups. The recovery objectives and the procedure are in Backup and recovery.

Monitoring

• Alerts on CPU, memory and disk usage for the nodes, the database and the cache.
• Automatic health check of the services every 45 seconds, with an alert to the technical team when one fails.
• Centralized logging of application errors.

Development

• Code is managed on GitHub, with version control and review of changes before they are merged.
• Every change goes through automated tests.
• The dependencies of the server-side services are reviewed every week with an automated tool that proposes security updates.

Certifications

LingoQuesto doesn’t hold its own information security certifications, such as ISO 27001 or SOC 2. The platform runs on providers that do hold them: DigitalOcean, AWS and Microsoft Azure.

Security testing by the institution

An institution can carry out security testing on the platform if it coordinates with LingoQuesto in advance, to define the scope and avoid affecting other customers’ service.