GIS hosting security: what protects your data at LizPack

GIS hosting security: the principle at LizPack

LizPack is an open source geospatial infrastructure: it deploys, connects, updates and monitors well-established free software (Lizmap, QGIS Server, PostgreSQL and PostGIS, GeoServer, QField), without replacing any of it. The security of your data therefore rests on two things: the security built into this software itself, which is maintained by its communities, and the way LizPack installs, isolates, updates and monitors it for you.

This guide describes only the measures published on the LizPack product pages. It does not discuss certifications or server locations, because that information does not appear on our public pages. If your organization has specific requirements on these points, ask the support team about them before you subscribe, or address them by installing LizPack Entreprise on your own infrastructure.

The measures fall into five families, each one detailed in the sections that follow: encryption of data in transit, isolation of workspaces, protection against data loss, monitoring of services, and portability, that is, your ability to take your data elsewhere.

Encrypted connections along the entire path

Your data travels at several different moments: when a visitor views a map in a browser, when you publish a project from QGIS, and when a GIS specialist connects to a database. Each of these trips is encrypted.

Automatic certificate renewal matters as much as the certificate itself. An expired certificate triggers warnings in every browser and pushes visitors into the bad habit of clicking through security warnings without reading them. On a LizPack Map instance, this is something you never have to think about.

Encryption protects the trip, not the content once it has arrived: a public map is still a public map, even when it is served over HTTPS. That is why the following sections cover the isolation of workspaces and the configuration of access rights, which are what actually decide who can see what.

Isolated workspaces and separate access

On shared infrastructure, the first question is always whether other customers can see your data. Each LizPack solution answers it in its own way.

• GeoServer Cloud. Each account has its own GeoServer workspace, with its own credentials. Your layers and your styles are visible only to you; the layers belonging to other accounts are neither visible nor accessible to you, and the reverse is also true.
• PostgreSQL and PostGIS databases. Each dedicated database has its own credentials, which are provided when it is created. It is dedicated to your account alone.
• Lizmap instances. There is one PostgreSQL/PostGIS database per instance. Starting with the Basic plan, each instance also has its own QGIS Server. Access rights to each map are configured in the Lizmap administration interface.
• LizPack Field. Collaborators are invited project by project, and each one is given a specific role.
• LizPack Viewer. What gets shared is the map, not the data: each person sees only the layers from the projects they have access to. Without an account, only the layers from public projects are displayed.
• LizPack Catalogue. A dataset that is for sale shows only its preview; its attributes and its files are reserved for buyers.

On the hosted offer, LizPack does not provide administrator access to the shared servers. This is a deliberate choice: it is precisely what makes it possible to guarantee their security and keep them up to date. You work from the customer area, the online file manager and the QGIS plugin, without ever opening a session on a server.

Staying in control of what you share

A large part of a map's security is configured on your side, with the tools that are provided to you. Default settings are no substitute for a conscious decision about what should be public and what should not.

• In Lizmap, set the access rights for each map in the Lizmap administration interface: either a public map, or a map restricted to certain accounts or groups. A layer that must not be seen should simply not be included in a project that is published publicly.
• In LizPack Viewer, sharing a map offers three levels: only you, the LizPack Field accounts that have the link, or everyone. You also choose the layers, the visible fields and the header. Only a map that is open to anyone with the link provides an embed code for a website.
• In GeoServer Cloud, each published service has its own address within your workspace: publish over WMS or WFS only the layers that are actually meant to be distributed.
• Within your team, invite the collaborators you need (up to five on the LizPack Map Pro plan), and no more than that.
• On your own computer, if you use LizPack Publisher, store your credentials in the QGIS authentication database rather than in plain text.

The guide Share a map online describes in detail the different ways to distribute a map and what each one means for the visibility of your data.

No silent data loss: quotas and alerts

The most common data incidents are not attacks, but full workspaces and accidental deletions. LizPack's rules are designed so that exceeding a limit never makes any data disappear.

1. Warn you. Alerts let you know before a workspace becomes full. For a dedicated database, an email is sent as soon as it reaches 60% of its capacity, and then again at 75, 80, 90 and 95%.
2. Give you time. Once the quota is exceeded, a 24-hour grace period lets you free up some space.
3. Stop without emptying. After that period, the database is stopped. It is never emptied: no data is deleted.

This choice has a visible cost, since a stopped database no longer feeds its maps, but it avoids the worst outcome: finding out after the fact that tables were truncated to fit within a quota. The successive alerts give you several opportunities to act before it ever comes to that. The guide Understanding LizPack plans and quotas details the quotas included in each plan.

Expiration, retention and backups

A subscription can come to an end, either by choice or by oversight. LizPack does not delete your data on the day it expires.

• 60-day retention. After a subscription expires, the instance stops, but its projects, its files and its database are kept for 60 days.
• Three warnings. Three emails notify you before anything is deleted.
• Restored exactly as it was. Renewing within that period gives you back the instance exactly as it was.
• Optional backups. Instance backups are offered as an option. Any added modules are part of the instance configuration, which is backed up and restored along with it.

Instance backups are an option: without it, protection relies on the retention rules described above and on your own copies. For important data, always keep a copy of your QGIS projects and an export of your databases on your side.

For LizPack Field, the Enterprise plan, which is deployed on your own infrastructure, includes daily backups. For LizPack Entreprise, backups are scheduled and can be copied to your own S3 storage.

Monitoring, updates and transparency

Up-to-date software is safer software. On a LizPack Map instance, updating Lizmap and QGIS Server is a one-click operation from the customer area. It is included starting with the Pro plan; on the Free and Basic plans, it costs 10 USD per component. GeoServer Cloud, for its part, is installed, secured and monitored by LizPack, with no updates for you to carry out yourself.

Monitoring works on two levels. The status of each instance's services is checked continuously, and a broken link between the components of an instance is detected and repaired. At the platform level, the overall status of the services is published on a public page: you can check for yourself whether an incident is in progress, without having to wait for an answer from the support team.

Finally, LizPack Publisher keeps a log of every operation, which can be copied in one click and attached to a support request. When something goes wrong, the diagnosis starts from facts, not from guesses.

Your ten-point checklist

The security of a hosted GIS is a shared responsibility: LizPack takes care of the infrastructure, and you take care of the content and the access. Here are the checks to carry out, from the moment you subscribe to your everyday work, using only the tools described above.

1. Choose the right plan. If several people need to edit the data from QGIS, you need the Pro plan, which enables the encrypted connection to the instance database.
2. Separate public and internal. Use one instance for public maps and another for working maps, rather than complex access rights on a single portal.
3. Set the rights in Lizmap for each map as soon as it is published, and review them whenever the team changes.
4. Keep the team small, limited to the people who actually need access, and remove those who leave.
5. Review projects before publishing them. Remove the layers and fields that do not need to be seen.
6. Choose the sharing level of each LizPack Viewer map, as well as its visible fields.
7. Read the quota alerts from the very first one, so that you can act while there is still some room to spare.
8. Run the updates of Lizmap and QGIS Server when they are offered.
9. Keep your own copies of your projects and database exports, and subscribe to the backup option if your data justifies it.
10. Check the public service status page before concluding that the problem is on your side.

Portability: your data stays in standard formats

Well-protected data is also data you can take with you. LizPack does not lock you in: everything you upload or produce stays in open formats that other software can read.

In practice, leaving LizPack means retrieving your projects and your files, exporting your databases, and then publishing them with a Lizmap installed on your own servers or at another hosting provider. The guide Host Lizmap or install it yourself describes what an installation of your own involves.

When your data must not leave your premises

Some organizations cannot entrust their data to a hosting provider, whatever measures are in place: sensitive data, regulatory obligations, internal policy. For them, LizPack Entreprise installs the same infrastructure on a server that they control.

• Data on site. Maps, databases, files and backups stay on your infrastructure, or on the storage of your choice.
• Your directory. Sign-in goes through Active Directory, LDAP or OpenID Connect (Entra ID, Keycloak), with roles, groups and per-map access.
• Backups and recovery. Scheduled backups, copies to your own S3 storage, and a complete rebuild on a new server.
• Updates under your control. You apply them when you decide to; the portal manager downloads the new version using your license and applies it without reinstalling, with your data preserved.
• Limited internet access. An internet connection is required to install and update; day to day, your users' computers only need to reach your server.

The guide On-premise GIS and data sovereignty explores this approach in more depth, and Hosted or on your own servers helps you choose between the two options.

Frequently asked questions