Security practices

Root & Branch Cloud follows industry-recognised security practices across infrastructure, network, application, and operations.

Infrastructure security

• Workloads run on isolated Kubernetes clusters with hardened node images.
• Networks are segmented by workspace and environment using Kubernetes network policies.
• Nodes and control planes are patched regularly through automated maintenance windows.
• We only work with data centre providers certified to ISO/IEC 27001:2022.

Network security

• All public traffic terminates at the edge with TLS 1.2 or higher.
• DDoS protection and web application firewall rules are enforced at the ingress layer.
• Internal service communication is encrypted where supported by the workload.

Identity and access

• Dashboard and API access require strong authentication.
• Role-based access control lets workspace owners define who can manage resources.
• API tokens can be scoped to specific apps and environments.

Vulnerability management

• Container images are scanned for known vulnerabilities during build.
• Dependency updates are tracked and applied on a risk-based schedule.
• Independent penetration tests and security reviews are performed regularly.

Logging and monitoring

• A 24-hour monitoring and alert system notifies the security operations team of suspicious activity and infrastructure malfunctions.
• Security-relevant events are centrally logged and regularly reviewed.
• Alerts are triaged and escalated according to severity.