Security by Design
Controls are designed into the target architecture from the first landing-zone decision — not added after the fact.
Security & Trust
Trust Center
Security, resilience and operational transparency designed into every engagement.
Security Principles
Security built in, not bolted on.
Least Privilege
Every identity, workload, and engineer receives the minimum access required, scoped and reviewed. Nothing is trusted by default.
Defense in Depth
Multiple independent layers — network, identity, encryption, and validation — so no single control is a single point of failure.
Recovery First
Disaster recovery is drilled live before handover; cutovers are rehearsed, measured, and instantly reversible.
Infrastructure
Built on trusted, hardened platforms.
Our own services run on established cloud providers, and every client migration inherits the same disciplined controls.
Cloudflare
Global edge delivery with TLS termination, DDoS mitigation, and a web application firewall in front of public services.
Amazon Web Services
Compute and storage in established AWS regions, configured to least-privilege and segmented by environment.
Encrypted Storage
Data at rest is encrypted using industry-standard algorithms, with keys managed under scoped access.
Encrypted Communication
All traffic to and between services is protected in transit with TLS; plaintext channels are not used for sensitive data.
Monitoring & Logging
Systems emit telemetry and audit logs so activity is observable and anomalies can be investigated.
Backups & Disaster Recovery
Regular, encrypted backups paired with rehearsed recovery procedures, so restores are demonstrated rather than assumed.
Data Protection
Your data, handled with discipline.
Protection follows the data through its whole lifecycle — from the network edge to secure deletion.
Encryption in Transit
TLS protects data moving between clients, services, and cloud providers.
Encryption at Rest
Stored data is encrypted with industry-standard algorithms and scoped key access.
Access Controls
Least-privilege access with MFA required for administrative and privileged operations.
Data Retention
Information is kept only as long as an engagement or applicable law requires.
Secure Deletion
When data is no longer needed it is securely deleted or irreversibly anonymized.
Responsible Disclosure
Report a vulnerability.
If you are a security researcher and believe you have found a vulnerability in our systems, we want to hear from you.
[email protected]How to Report
Email [email protected] with a clear description, affected component, and reproduction steps.
Coordinated Disclosure
We appreciate coordinated disclosure. Please give us reasonable time to investigate and remediate before any public discussion.
Please Avoid
Testing that degrades service, accesses other people's data, or destroys information. Act in good faith and stay within scope.
Operational Practices
How we run, day to day.
The disciplines behind every engagement — the same controls we apply to our own estate.
Identity & Access
Access is granted under least privilege and reviewed as engagements change. Multi-factor authentication is required for administrative and privileged operations.
Change Management
Changes are planned, peer-reviewed, and reversible. Nothing reaches a production estate without a documented path forward and a path back.
Monitoring & Logging
Systems emit telemetry and audit logs so activity is observable, anomalies are investigable, and cutovers are measured rather than guessed.
Backup Validation
Backups are encrypted and access-controlled — and restores are exercised. A backup is only counted once it has been proven to recover.
Incident Response
Detection, escalation, and communication follow a defined path, so the response to an issue is rehearsed rather than improvised.
Business Continuity
Disaster recovery is designed into the architecture and drilled live before handover, with recovery objectives demonstrated on record.
FAQ
Answers to common questions.
Where is data stored?
Our website and client-facing services run on Cloudflare and Amazon Web Services (AWS). Migration work itself is performed inside your own cloud accounts and chosen regions — we do not take custody of your production data beyond what a given engagement requires.
How are backups protected?
Backups are encrypted and access-controlled under least privilege. Recovery is rehearsed as part of every migration, so restores are demonstrated before handover rather than assumed.
How is encryption handled?
Data is encrypted in transit with TLS and at rest with industry-standard algorithms such as AES-256. Encryption keys are managed with scoped, least-privilege access.
How do I report a vulnerability?
Email [email protected] with a description and reproduction steps. We appreciate coordinated disclosure and will acknowledge legitimate reports.
Do you use multi-factor authentication (MFA)?
Yes. MFA is required for administrative and privileged access wherever it is supported.
How are credentials protected?
Secrets and credentials are held in a managed secrets store — never in plaintext or source control. Passwords are hashed where applicable, and access is scoped by least privilege.
Do you hold a formal security certification?
We do not claim any certification we do not hold. What we can show you is how we operate: least privilege, defense in depth, encryption in transit and at rest, monitoring and logging, validated backups, and rehearsed recovery — set out in our Operational Practices above.
Who performs the migration work?
The same senior engineers who scope and architect your migration execute the cutover. There is no hand-off to a junior delivery team.
Next Step
Need to discuss your recovery strategy?
Start with a ten-day assessment — inventory, TCO comparison, and a disaster recovery gap analysis.