Frappe Cloud Security FAQ
This document answers common questions about the security architecture, infrastructure, data protection, patch management, disaster recovery, and compliance practices followed by Frappe Cloud.
Network Security & Access Control
How is network security implemented?
Frappe Cloud secures its infrastructure using a combination of Virtual Private Clouds (VPCs), security groups, and firewalls. Resources are isolated within private networks, and only the required ports are exposed to the public internet. All other ports remain blocked by default.
How is server access managed?
Server access is secured using SSH certificates and public key authentication. Password-based SSH login is disabled. Users are granted SSH access only to the benches they are authorized to manage.
Is a Web Application Firewall (WAF) available?
Frappe Cloud does not currently provide a dedicated Web Application Firewall (WAF). However, a server-level firewall is available to help protect infrastructure.
Are outgoing network connections restricted?
No. Outbound network requests are currently unrestricted unless configured otherwise by the customer.
Is an Intrusion Detection or Prevention System (IDS/IPS) used?
No. Frappe Cloud does not currently implement an Intrusion Detection System (IDS) or Intrusion Prevention System (IPS).
What DDoS protection is available?
Frappe Cloud does not currently provide dedicated Distributed Denial-of-Service (DDoS) mitigation services.
Data Protection & Encryption
Which database is used?
Frappe Cloud uses MariaDB as its database engine. Databases are managed directly on AWS EC2 instances rather than managed database services such as Amazon RDS or Aurora.
Is database High Availability (HA) supported?
High Availability is not enabled by default. Customers using Dedicated Servers can request database replication through the Frappe Cloud Support Portal.
Is automatic database failover available?
No. Automated database failover is not currently available.
What are the Recovery Point Objective (RPO) and Recovery Time Objective (RTO)?
Database backups are created once every 24 hours, providing an RPO of up to 24 hours. Recovery time depends on the database size and restoration process, although disaster recovery drills typically complete in under 15 minutes.
Is Point-in-Time Recovery (PITR) supported?
No. Point-in-Time Recovery is not currently available.
How is data encrypted during transmission?
All internet communication is secured using HTTPS (TLS). SSH sessions are also fully encrypted.
Are databases encrypted at rest?
No. MariaDB databases are not encrypted at rest by default.
Are backups encrypted?
Backups are not encrypted by default. Customers can enable backup encryption using Frappe’s backup encryption feature, which uses Fernet encryption (AES + HMAC).
Are storage volumes encrypted?
No. AWS EBS volumes attached to Frappe Cloud servers are not encrypted by default.
Security Monitoring & Management
What anti-malware solution is used?
Frappe Cloud uses ClamAV for malware protection. Virus definitions are updated manually when required. Continuous or scheduled scans are not enabled to avoid unnecessary performance impact.
Is an Endpoint Detection and Response (EDR) solution deployed?
No. Frappe Cloud does not currently use an EDR solution.
Are containers scanned for vulnerabilities?
No. Container vulnerability and malware scanning are not currently performed.
Is Multi-Factor Authentication (MFA) used?
Yes. Multi-Factor Authentication (2FA) is enabled for all Frappe-managed third-party service logins.
Patch Management & Updates
How are operating system security patches managed?
Security patches are deployed automatically using Ubuntu’s unattended-upgrades service, which installs updates daily across servers.
How are Frappe Framework updates handled?
On shared benches, updates are managed by the Frappe Cloud team and are typically released weekly or during major updates. Dedicated and private bench customers can manage framework updates themselves.
How are MariaDB updates managed?
MariaDB security updates are delivered through Ubuntu’s unattended-upgrades mechanism.
How are Python packages and dependencies updated?
Python versions and application dependencies are managed from the Bench → Dependencies section of the dashboard.
Is there a formal patch management process?
Yes. Frappe Cloud follows a structured patch management process that includes continuous patch deployment, vulnerability assessments, vendor security advisories, automated critical patch installation, and rollback procedures when necessary.
- Continuous patch deployment.
- Vulnerability assessment reviews.
- Vendor and security advisory monitoring.
- Automatic installation of critical Ubuntu security patches.
- Rollback support using backups when required.
Where can recent security advisories be found?
Security advisories are published through the official GitHub Security Advisory pages for both the Frappe Framework and Frappe Cloud projects.
Version Information
How can I check the current Frappe version?
Navigate to Bench → Apps in the Frappe Cloud dashboard.
How can I check the MariaDB version?
Go to Server → Actions → View Database Configuration.
How can I check the Python version?
Navigate to Bench → Dependencies.
Backup & Disaster Recovery
What backup policy does Frappe Cloud follow?
Logical site backups are performed according to the Frappe Cloud backup policy. Additionally, complete server snapshots, including attached data volumes, are taken daily and retained for 2 days.
What disaster recovery measures are in place?
Frappe Cloud maintains daily multi-Availability Zone (Multi-AZ) server snapshots. In the event of a disaster, infrastructure can be restored using these snapshots.
Compliance & Certifications
What certifications does Frappe hold?
Frappe is certified under the following internationally recognized standards:
- ISO 9001:2015
- ISO 27001:2022
- SOC 2 Type II
Does Frappe Cloud perform penetration testing?
Yes. The Frappe Cloud platform undergoes formal third-party penetration testing on a regular basis, with recent assessments completed within the last 12–18 months.
Are vulnerability scans performed?
Yes. Regular internal and external vulnerability scans are conducted as part of Frappe Cloud’s ongoing vulnerability management program.
Frappe Cloud follows industry-standard security practices for infrastructure protection, access control, patch management, backups, and compliance. While certain advanced features such as database encryption at rest, automated failover, IDS/IPS, and dedicated DDoS protection are not currently available, the platform provides secure authentication, regular updates, vulnerability management, daily backups, and internationally recognized security certifications.
