Technology & Security
At mentaBase we are transparent about how our platform is built and operated: servers, security, backups, monitoring and service continuity.
These are the main building blocks of mentaBase infrastructure:
Servers
The mentaBase platform runs on high-performance dedicated servers, tuned for stability, security and continuous availability.
Location & reliability
European data centers with security certifications, redundant network and power, and 24/7 monitoring to ensure service continuity.
Per-application isolation
Each customer application runs in a separate environment to avoid interference, simplify maintenance and improve operational security.
Reverse proxy & HTTPS
All traffic goes through a reverse proxy with modern TLS (HTTPS enforced) and automatic certificate renewal.
Maintenance & updates
Regular system and dependency updates with planned maintenance windows to minimize impact and preserve stability.
Backups
At mentaBase we operate two complementary levels of backups:
- Infrastructure backups: full snapshots of servers and system components, ensuring service continuity even after major failures or updates.
- mentaBase backups: encrypted, automated backups of each application, protecting the data, documents and records of your strains stored in the app.
Both levels are periodically verified to ensure integrity and fast recovery in case of incidents.
Encrypted with Restic
Backups with Restic encrypt and deduplicate data
before transfer. Keys managed in .env-restic and E2E-encrypted snapshots.
Redundant storage
Encrypted copies in independent providers like Backblaze B2 and Hetzner Storage Box, ensuring geo-redundancy and high availability.
Automation & retention
Automatic runs via cron (scripts in /home/crones/restic/) with retention policies
that keep recent copies and prune obsolete ones.
Full Docker project backups
Automatic discovery of projects under /home/docker with docker-compose.yml;
we back up files and persistent volumes to restore services, databases and configuration.
Security & isolation
Credentials and keys in .env-restic, HTTPS reverse proxy for traffic and E2E-encrypted backups.
Minimal privileges and isolation from production environments.
Continuous verification
Automatic integrity checks (restic check) and periodic reviews
(restic stats) with alerts on any failure.
Monitoring & alerts
Continuous monitoring of servers, network and applications, with clear dashboards and real-time alerts.
Servers (Beszel)
Real-time metrics for CPU, RAM, disk and processes with Beszel, per-host history and early detection of bottlenecks.
Network speed (MySpeed)
Scheduled tests with MySpeed to measure download, upload and latency, with alert thresholds for sustained degradation.
App availability (Uptime Kuma)
HTTP/HTTPS monitors with Uptime Kuma, response times, history and optional public dashboard per application.
Alerts & channels
Real-time notifications (email and/or messaging) on outages, high latency or critical resources; retries and recovery confirmation.
Thresholds & SLOs
Operational thresholds (CPU, memory, disk, ping) and service-level objectives to detect drifts and prioritize response.
Dashboards & history
Unified dashboards with per-metric history and report exports for audits and periodic reviews.
Updates & maintenance
At mentaBase we follow an active update and continuous improvement policy to keep both the application and its underlying infrastructure secure, stable and optimized.
Versioning & changelog
Each mentaBase release follows semantic versioning (vX.Y.Z)
with a detailed CHANGELOG.md for technical traceability.
Database migrations
Structural changes are applied through controlled scripts (/database/migrations/),
verifying versions before and after each run.
Security patches
Regular patching of OS, containers and dependencies, following Debian’s maintenance cycle and PHP library updates.
Maintenance windows
Planned tasks (updates, reboots, migrations) are executed during low-usage timeframes to minimize impact, with prior notice to affected customers.
Automation with cron
Automated processes for review, integrity checks and minor dependency updates through scheduled tasks.
Post-update validation
Automatic checks after each update: app access, database integrity and critical services’ response before marking the version as stable.
Access security
Security is a core pillar of mentaBase. We protect platform access with encrypted authentication, permission control and environment isolation.
Secure authentication
Access is protected via HTTPS with encrypted credentials. Upcoming integration with Keycloak for centralized user management and OIDC authentication.
Permission control
Access roles (Administrator, Curator, Technician) with differentiated permissions for read, write and admin. Every action is recorded in the history.
Sessions & tokens
Session control through signed tokens and configurable expiry. Automatic session regeneration after critical permission or password changes.
End-to-end encryption
All traffic is encrypted with TLS 1.3 and Perfect Forward Secrecy (PFS). Passwords are stored with secure algorithms.
Environment isolation
Each customer runs in its own isolated Docker environment, with private networks and restricted access to the services of its collection.
Audit & activity logs
Detailed logs of access, modifications and user actions in the database, providing full traceability for audits.
Privacy & compliance
At mentaBase we handle scientific information and collection data under the highest confidentiality standards, following European data protection regulations and good records-management practices.
GDPR compliance
We comply with the General Data Protection Regulation (EU) 2016/679, ensuring lawful, transparent and limited processing of scientific and personal information.
Data confidentiality
The data and documents linked to each collection are confidential and remain under the exclusive control of the owning entity. No information is shared without explicit authorization.
Access control
Each user can only access the data and collections assigned to them. Roles and permissions are managed granularly at the application level.
Data retention & deletion
Data is kept only as long as needed for collection management and securely deleted upon expiry or explicit request.
Encryption at rest
Files stored on servers and in backups remain encrypted at all times, with per-instance keys and secure credential management.
Transparency & audit
We provide full transparency in data handling and access logs, with audit options on request by the owning entity or the security lead.
Continuous support: because infrastructure matters as much as care. At mentaBase, every collection receives personalized technical assistance, proactive maintenance and direct communication with the team behind development and operations.