Service · Cloud & Security

Right-sized security, because the risk is real and the budget is not infinite

You do not need a bank's control framework. You need to survive an employee leaving with access, a laptop dying, a mistaken deletion, and a customer sending a security questionnaire. We build for those four.

  • Access tied to roles, removable the day someone leaves
  • Backups that are tested by restoring, not assumed
  • Audit trail on the actions that touch money or customer data
  • Plain-language answers ready for customer security reviews

What you get

Deliverables, not slideware

  • 01

    Account and access review

    Who has access to what today, including the accounts nobody remembers creating, and what to revoke first.

  • 02

    Hosting setup

    Environments, deployment, and monitoring configured under your own cloud account, with costs visible.

  • 03

    Backup and restore drill

    Scheduled backups plus an actual restore performed in front of you, because an untested backup is a rumour.

  • 04

    Questionnaire pack

    Written answers to the security questions your enterprise customers ask, kept current as the setup changes.

restore-drill.md
  • 01Scenario: production database deleted at 09:12
  • 02Restore started 09:14 — completed 09:41
  • 03Data loss window: 11 minutes of writes
  • 04Gap found: file storage was not in the backup set
  • 05Fixed and re-drilled: pass, 27 minutes
Sample of the deliverable. A backup is only real once a restore has been timed.

How it runs

What actually happens, step by step

No discovery theatre. Each step ends with something you can read or use.

  1. 01

    Access review

    Who can reach what, including the accounts nobody remembers creating.

  2. 02

    Harden hosting

    Environments separated, secrets moved out of shared documents, logging turned on.

  3. 03

    Restore drill

    We delete something on purpose in a safe copy and restore it, timed.

  4. 04

    Questionnaire pack

    Written answers your team can reuse the next time a customer asks.

Tangible

What lands in your hands

Named objects with a format and a week attached, so the handover is easy to picture.

  • System blueprint

    Services, queues and data paths, drawn once and kept current.

    PDF · 6 pagesWeek 2
  • Source repository

    Yours from day one. Commit history, README and setup script included.

    Git repo + READMEWeek 1
  • Running environment

    The thing itself, deployed, with your data and your users on it.

    Live URLPhase one
  • Handover pack

    Access, documentation and a recorded session with your team driving.

    Recording + notesFinal week
Sample

System Blueprint

Every service, queue and data path, drawn once and kept current.

6 pp
Download the sample (PDF)

This is the real template, with client figures replaced by representative ones. Read it before you talk to us — if the format is not useful to you, the engagement will not be either.

Before and after

What the change looks like in the week

Red is the cost you carry today. Green is what the system gives back.

Today

  • Shared logins that outlive the people who used them
  • Backups nobody has ever restored from
  • A single laptop holding something the business cannot replace
  • Security questionnaires that stall a deal for weeks

After

  • Named accounts with roles, revoked on the last day
  • Restores tested on a schedule, with evidence
  • Nothing critical living only on one machine
  • Questionnaires answered from a prepared pack in a day

Objections

Answered before you ask

Do we need a compliance certification?

Only if a customer contract requires one. Most companies your size need good practice and clear answers, not an audit programme they cannot sustain.

Will this slow the team down?

Controls that get in the way get bypassed, which is worse than nothing. We choose the smallest set of controls that actually holds.

Can you work with our existing IT provider?

Yes. We usually document the target setup and let your provider operate it, so you are not adding another dependency.

One next step, and it is a paid one on purpose

The AI Opportunity Diagnostic is a fixed-scope engagement. You leave with a ranked plan you can act on with us or without us.

Still sizing the problem? Write to us in your own words first. A person reads it.