# Operations Security Policy

Last updated: October 28, 2026

Production on GCP runs from a hardened baseline, is monitored and logged continuously, and is scanned and patched on fixed deadlines.

## Scope

All GCP projects, production services, CI/CD pipelines and supporting tools in both EU and US regions.

## Policy

### Environments and configuration

1. Production and staging/development run in separate GCP projects. Production access is restricted per the Access Control Policy.
2. The GCP organization enforces Google's secure-by-default organization policies. Application servers have no public IP addresses and accept traffic only from Google's load balancer, plus administrative access through Identity-Aware Proxy. Postgres and Redis are reachable only on private addresses inside our network, and the analytics database accepts connections only from each region's own fixed address. Storage buckets block public access, except the one that serves the web app's public files.
3. Infrastructure changes go through infrastructure as code and the change process in the Secure Development Policy.

### Logging and monitoring

4. Cloud Audit Logs, application logs and access logs are centralized in a logging service. Admin Activity and System Event audit logs are retained for 400 days. Data Access audit logs, application logs and access logs are retained for at least 30 days. Logs containing Customer Data are kept in the customer's region.
5. Alerts are configured for: production availability (uptime checks for each region and the web app); resource saturation on application servers, databases and caches; IAM policy changes; new service account keys; firewall changes; changes to production databases; access to production secrets; and every shell session on a production server.
6. Uptime and capacity are monitored, and capacity is reviewed against growth.

### Vulnerability and patch management

7. Dependencies are scanned automatically on every build and infrastructure is checked.
8. Vulnerabilities are fixed within: Critical 7 days, High 30 days, Medium 90 days, Low at discretion. Deadlines apply from when a vulnerability is confirmed to affect Summerbase. Exceptions follow the exception process in the Information Security Policy.
9. Managed services (Cloud Run, GKE Autopilot, Cloud SQL) are preferred so Google patches the underlying platform.

### Malware and endpoint protection

10. Laptops run endpoint protection and are kept updated, verified twice a year (Acceptable Use Policy).

### Capacity and availability

11. The production service is designed for high availability, as set out in the Information Security Policy, and to be recoverable as set out in the Business Continuity and Disaster Recovery Plan.