VPC Isolation: The core application logic runs within a dedicated AWS VPC.

Private Connectivity:

• Connectivity to MongoDB is established via AWS PrivateLink, ensuring traffic never traverses the public internet.

• Connectivity to AWS Neptune and Redis is restricted to internal application subnets via Security Groups.

• Connectivity to Pinecone is secured via encrypted TLS tunnels with strict API Key rotation policies.
  
  

Zero-Trust Access: Service-to-service communication is governed by least-privilege IAM policies. Services can only access the specific data stores required for their function.