> For the complete documentation index, see [llms.txt](https://docs.inrupt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.inrupt.com/security/security-checklist.md).

# Security Checklist

The following provides some general guidelines with respect to securing your ESS deployment. The checklist is not meant to be an exhaustive list.

### Limit Network Exposure

| Limit external access to specific networks/ports.                                                                                                                               |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Separate internal and external traffic. For example, by running inside a VPC, you can ensure that all communication within the VPC is securely separated from external traffic. |
| <p>If setting up a VPN endpoint, avoid manually adding public<br>Internet routes/authorizations to the VPN endpoint .</p>                                                       |

### Use Encryption

| <p>Use TLS for network encryption.</p><ul><li>Encrypt in-transit inbound traffic to ESS.</li><li>For external facing services, use TLS certificates from an official Certificate Authority (CA). Do not use self-signed certificates.</li></ul> |
| ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Encrypt data at rest, including audit logs.                                                                                                                                                                                                     |

See [Encryption](/security/encryption.md)

### Manage and Safeguard Sensitive Data/Credentials

| Many strategies for safeguarding sensitive data/credentials exist for Kubernetes. Investigate the best available options for your environment.                                       |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Secure highly-sensitive (i.e., passwords, tokens, etc.) environment variables. Do not set these environment variables on the containers as they are stored and passed in plain text. |
| Take care about what and to whom you grant access.                                                                                                                                   |