Private subnets: All services run in private subnets without public IP addresses. No service is directly accessible from the internet.

Least-privilege network rules: Each service is only allowed to communicate with the services it needs for its function. All other connections are blocked.

Complete environment separation: There are no network connections between environments (EU, US, CH, DEV) — no VPC peerings, no cross-account routes. Each environment is fully isolated.

Internal traffic: Access to storage and database services is routed through private endpoints within the AWS network and does not leave it.

Controlled outbound: Outbound internet traffic is centrally routed through a NAT gateway and filtered by DNS firewall rules.