Security & Compliance
Boring, until it is not.
Malware protection, SSL, backups and uptime monitoring, plus the consent and privacy basics GDPR expects, set up once and then monitored.
Migrations, logging and tests written first, not last
How we think about it
Security work is invisible until the week it is the only thing that matters. We do the unglamorous parts — dependency and access audits, sensible secrets handling, backups that have actually been restored — and map them to whatever standard you are being asked to evidence, so the next questionnaire is an export rather than a scramble.
The review is done by people who ship production systems here, which is why findings arrive with a fix rather than a severity rating and an invoice.
What this covers
The work, specifically.
- 01
Website security
Hardening, malware scanning and cleanup, plus the updates that prevent most of it.
- 02
SSL, backups and uptime
Automated backups you have actually tested restoring, and alerts when the site goes down.
- 03
GDPR & cookie consent
Consent banners, privacy policy and data handling that meet UK and EU requirements, plus CCPA where you sell into California.
- 04
Data protection setup
Access control and retention rules, so customer data is not sitting in five inboxes.
Need Security & Compliance for something specific?
Tell us what you're trying to ship and we'll say plainly whether this is the right service for it — including when the answer is no.
How it runs
The same four steps, whatever we're building.
No account-manager relay. The lead on your project is someone who builds, and they stay on it from the first call to the last deploy.
Scope
A week of hard questions. We map what you actually need and say plainly which parts we'd cut.
Prototype
Something real in front of you early, not a document about it. Opinions get cheaper.
Build
Two-week cycles, a demo at the end of each. You see progress, not status reports.
Hand over
Documentation, a walkthrough, and the keys. Support if you want it — never as a hostage.
Questions
The things people ask before they enquire.
It depends on scope, but we will give you a number before you commit to anything. Most engagements start with a paid discovery — a fixed fee, a week or two — which ends in a written scope and a real budget. If the budget does not work, you leave with the scope document and no obligation to continue.
A typical first ship is around six weeks. Larger builds run in two-week cycles after that, each ending in a demo of something that actually runs. You will know within the first cycle whether the timeline is holding, rather than finding out near the deadline.
The people you meet. The lead on your project is someone who builds, and they stay on it from the first call to the last deploy. There is no account manager relaying messages between you and an unseen team.
You own everything — code, assets, accounts, domains. We hand over with documentation and a walkthrough, and your team can run it without calling us. If you would rather we stayed on for maintenance or a next phase, that is a separate agreement, not something buried in the original contract.
Yes. Most of our work is remote, and we keep a few hours of overlap with your working day for calls. Timezone has not been the hard part; unclear scope has.
Where it meets the others