Security Policy — Zaburex
Operational security

Security
Policy

🇩🇴 ES🇺🇸 EN

1 Security Commitment

Zaburex implements technical and operational controls to protect DNS infrastructure, client data, and service availability. This policy describes our security practices.

2 Infrastructure and Architecture

  • Two geographically distributed DNS nodes (NYC and Atlanta) on DigitalOcean
  • Geographic redundancy with automatic failover
  • TLS 1.2+ encrypted communications across all services
  • DNS over HTTPS (DoH) and DNS over TLS (DoT) with valid certificates
  • Perimeter firewall with restrictive rules per service
  • Fail2ban active on all servers against brute force attacks
  • DNSSEC validation active on the Unbound resolver

3 Data Protection

  • Data in transit encrypted with TLS/HTTPS
  • Access restricted via authentication
  • Administrative role separation
  • Audit logs for critical actions
  • Periodic configuration backups
  • We do not store browsing content, only DNS metadata

4 Monitoring and Detection

  • Real-time monitoring with Grafana + Prometheus
  • Log aggregation with Loki
  • Automatic alerts for traffic anomalies
  • Per-IP rate limiting to prevent DNS amplification
  • ANY query blocking to reduce attack surface

5 Vulnerability Management

Zaburex maintains a vulnerability management process including automatic security updates (unattended-upgrades), periodic configuration review, and response to critical CVEs in stack components (dnsdist, Unbound, Nginx).

6 Vulnerability Disclosure

If you discover a security vulnerability in the Zaburex platform, please report it responsibly to [email protected]. We commit to:

  • Acknowledge receipt within 48 business hours
  • Investigate and validate the report
  • Implement fixes within a reasonable timeframe based on criticality
  • Notify the researcher when the vulnerability is resolved

Do not conduct active penetration testing against Zaburex infrastructure without prior written authorization. Unauthorized access may result in legal action.

7 Security Incidents

In case of a security incident affecting client data, Zaburex will notify affected parties per the timeframes established by Dominican Law 172-13 and applicable U.S. laws, including CCPA for California residents.

8 Security Contact

Vulnerabilities and security reports: [email protected]
Abuse and malicious activity: [email protected]
Legal and compliance: [email protected]