Security & reliability

What you get

Six layers of controls and the evidence that they work: scan results in the pipeline, an audit log in the application, and alerts that page a human.

How it works

IDENTITY → API → APPLICATION → CONTAINER → DATABASE → INFRASTRUCTURE. Each layer has named controls: MFA and RBAC, mTLS and rate limits, input validation and CSP, non-root read-only containers, encryption and PITR, hardened hosts.

What we measure

Time to patch a critical CVE, mean time to detect and to restore, error budget burn against the SLO, and the result of the last restore drill.

Controls that survive a bug in the code

Most security work protects you from an attacker. The controls worth the most protect you from your own future mistake, because that is the likelier event.

The clearest example is database privilege. An endpoint that only ever writes should connect as a role that can only insert — no select, anywhere. Then a bug in the handler, an injection that reaches the connection, or a careless query added in a hurry cannot read a record out, because the database refuses. Validation and code review are good; they are also code, and code has bugs. This is the database saying no.

The same logic applies elsewhere. Containers run non-root with a read-only filesystem, so a compromised process cannot write a binary. Secrets live outside the repository, so a leaked clone is not a leaked credential. Network policy denies by default, so a service that should never reach the internet cannot, whatever it is tricked into trying.

None of these depend on anyone remembering anything.

Backups are a restore you have practised

A backup nobody has restored is a hypothesis.

What we run is a timed drill into a scratch environment: write a marker, record the moment, write a second marker, then restore to a point between them and confirm the first marker is present and the second is not. That proves point-in-time recovery works and tells you how long it takes, which is the number you actually need when deciding what to promise.

Retention is set to match whatever your privacy notice already says. A longer window quietly makes that sentence false.

What this is not

We are not a penetration testing firm. We build and operate the controls; an independent test of them should come from someone with no stake in the result, and we will say so when a procurement process asks us to mark our own work.

We do not issue compliance certifications. We can build to what a standard asks for and produce the evidence an auditor wants — scan results, access records, the audit log, the restore drill — but the certificate comes from a certifying body.

And we do not promise you will not have an incident. We make them less likely, contained when they happen, and recoverable with a known, rehearsed procedure.