Security, privacy and compliance
Finding weak spots before someone else does, protecting personal data the way the law expects, and getting you ready for the audits your customers ask about.
Services in security and governance
6 services. Open any of them for what’s included, when it makes sense and what you get.
Application and cloud security
Finding the weak spots before someone else does.
- Security reviews and secure code review
- VAPT
- Cloud hardening
- Secrets and key management
Identity and access
The right people get in.
- Single sign-on
- Multi-factor login
- Role-based access
- Access reviews and offboarding
Data protection and privacy
Personal data handled the way the law and your customers expect.
- Data mapping
- Encryption
- Masking and tokenisation
- Consent, retention and deletion
Data governance
Clear owners and clear rules, so people can trust the data.
- Ownership and stewardship
- Catalogues and lineage
- Data quality rules
- Classification
Compliance and audit readiness
Ready for the audit before the auditor arrives.
- Gap assessment
- Policies and procedures
- Controls and evidence
- Audit support
Backup, recovery and incident response
A plan for the bad day, tested before you need it.
- Backup strategy
- Restore tests
- Disaster recovery plans and drills
- Incident response playbooks
Projects we take on
The kinds of work clients bring to this practice.
A security review before launch
Code and configuration reviewed, with a written report of what we found and what to fix first.
Vulnerability assessment and penetration testing
Your app and cloud tested the way an attacker would, with findings ranked by severity.
DPDP Act readiness
A map of where personal data lives, plus consent, retention and deletion workflows.
ISO 27001 and SOC 2 readiness
Policies, controls and evidence in place before the auditor arrives.
Access clean-up
Single sign-on, multi-factor login and a review of who can access what.
Backups you’ve actually tested
Restore tests and a disaster recovery plan you’ve rehearsed.
How we approach it
Plain-language reports
Every review ends with a written report: what we found, how serious it is and what to fix first.
Fixes, not just findings
We can fix what we find, or work alongside your team while they do.
Straight about certificates
We get you ready for ISO 27001 and SOC 2. The ISO certificate comes from an accredited certification body, and a SOC 2 report from an independent CPA firm.
Specialists named up front
Where a review needs a specialist we don’t have in-house, you hear it on the first call and they’re named in the proposal.
Who works on it
If your project needs a specialist we don’t have in-house, you hear it on the first call, and they’re named in your proposal before any work starts.
Questions about security and governance
Where should a small company start with security?
With the basics that stop most incidents: multi-factor login everywhere, removing old accounts, backups you’ve tested, and keeping software updated. We can check all four in a short review.
Do you sign an NDA before a security review?
Yes. A review means seeing sensitive details, so we sign an NDA and agree how findings are stored and shared before we start.
Other practices
Tell us what you need built.
A free 30-minute call with an engineer. You get the scope, timeline and price in writing before you commit, and a reply within one working day.