We enforce network segregation through different VPCs for staging and production environments and implement security groups.
The platform sits behind our Amazon CloudFront CDN which obfuscates our internal infrastructure. This allows for computing and storage to be in private subnets and adds encryption in transit by default.