ENS High
Spain's national security framework at its top level, with all five dimensions — confidentiality, integrity, traceability, authenticity and availability — at the high category.
Security that is demonstrated.
The right B2B question isn't “is it secure?”, but “how do you demonstrate it?”. Here is the answer: where your data lives, what the centre hosting it certifies and what we add on top.
Where your data lives
Your data lives in Barcelona. In Spain. On our own infrastructure, operated by us.
elstir doesn't resell a hyperscaler's cloud (the global cloud giants). We operate our own infrastructure in Barcelona, on our own network: the autonomous system AS49008 registered at RIPE, with a /23 IPv4 block and our own BGP routing. Your data resides in Spain, without depending on the big global platforms or on wherever they decide to host it.
Knowing where your data is — and who answers for it — is the first question of any serious audit. Here the answer is concrete: in Barcelona, under a single point of contact who doesn't have to learn your infrastructure — they're the ones who stood it up.
The data centre
A data centre certified to the highest level.
We operate our infrastructure in an Econocom Nexica data centre in Barcelona, certified to the sector's highest levels:
ISO 27001
The international standard for information security management.
ISO 9001
The international standard for quality management.
Cisco Powered
Cloud services architecture validated by Cisco.
Data protection (GDPR)
The data-processing chain, closed by contract: with each client and with the data centre.
We sign data processing agreements — Article 28 of the GDPR — according to what each client needs.
The chain doesn't stop with us: elstir in turn has its own processing agreement as a client of the data centre. Upstream too, the chain is closed by contract.
What we add ourselves
On that certified foundation, we put in the part that is ours.
Our own network and continuous replication
We operate our own network (AS49008) and replicate the machines continuously to a recovery host: an RPO of 5 minutes, the maximum data loss in the event of a failure. See the infrastructure.
Disconnected backups and verified recovery
The 3-2-1 rule — three copies, on two different media, one of them off-site — with air-gapped backups, physically disconnected from the network, and recoveries we test — not assume. Backups.
Email security
DMARC, SPF and DKIM with 95–100% protection across the domains we manage, and a periodic DMARC report per domain. Email security.
Endpoint with detection and response
ESET with EDR/MDR across workstations and servers: managed threat detection and response, not just antivirus. Cybersecurity.
Managed firewalls
SonicWall firewalls administered by CSSA-certified engineers: rules, VPNs and firmware kept up to date on every perimeter we manage. Cybersecurity.
Availability measured by a third party
Our RIPE Atlas probe tracks the network around the clock — you can watch it live: 4 ms median latency and 99.96% availability. The data is published by a third party, not by us; the figures, in context, are on the infrastructure page.
Measured and verifiable
- Availability
- 99.96% — measured by our own RIPE Atlas probe (public third-party data)
- Latency
- 4 ms median, from the continuous — and public — record of our RIPE Atlas probe
- RPO (maximum data loss)
- 5 minutes, thanks to continuous replication
- Email protection
- DMARC 95–100% across managed domains, with a periodic report per domain
- Backups
- 3-2-1 rule with an air-gapped copy and verified recovery
Continuity
If your premises go down, you start up in our Barcelona data centre.
Continuity is not a promise: it is a procedure we have tested. The real test came with the blackout of 28 April 2025: our servers did not go down. If your office loses power, network or servers, your systems start up on the replica we maintain in the Barcelona data centre.
The hybrid model keeps one foot on your premises and the other in our data centre, so the jump from one to the other is rehearsed. And the disconnected backups are the last safety net: if everything else failed, the recovery is verified.
Shall we talk about your infrastructure?
An initial audit with no obligation. Tailored solutions, with a single point of contact who knows your business.