Reliability and security audit of your platform
Prioritised risks and an improvement plan in 1-2 weeks. So you know where you stand before a customer, an auditor or an outage asks you.
Usual tools
- Graylog
- MongoDB
- MySQL
- SonarQube
- Wazuh
- WireGuard
In short
A reliability and security audit is a technical review of your platform to find what could cause an outage, data loss or unauthorised access. We review access, backups, deployments, vulnerabilities, monitoring, internet exposure and disaster recovery. From €1,500 (indicative price, excl. VAT), with a fixed price agreed before starting, delivered in 1-2 weeks, and it includes a report with a prioritised improvement plan.
- Languages
- Spanish, Catalan or English
- Response
- The next business day, during business hours
- Method
- In your account and your repository, in code and documented
What is included
- Identity and access review: who logs in, with which permissions and whether two-factor authentication is on.
- Backups and recovery: what is backed up, where, and a test restore.
- Internet exposure: ports, admin panels, buckets and certificates.
- Deployments, secrets and the image supply chain.
- Monitoring, alerting and audit logging.
- Report with prioritised risks, evidence, recommendation and effort (S, M or L).
- Prioritised improvement plan and a session to walk your team through it.
- Fixed price before starting and delivery in 1-2 weeks.
- Supporting answers for customer security questionnaires.
When is an audit worth doing?
Before a problem makes it unavoidable. The moments when we are asked for one most often:
- A large customer sends you a security questionnaire or asks for ISO 27001, ENS or NIS2.
- There has been an outage or a scare and you want to know what else could fail.
- The person who built the platform has left and nobody knows its real state.
- You are about to raise a funding round or sell the company and a technical review is due.
- You have spent years growing without reviewing access, backups or exposure.
What do we review?
The audit covers seven areas. In each one we look for the same things: what could fail, what evidence shows it and how much it costs to fix.
| Area | What we review | Evidence you receive |
|---|---|---|
| Identity and access | Users, roles, old keys, two-factor authentication, shared accounts | List of risky access and a least-privilege proposal |
| Backups and recovery | What is backed up, frequency, immutability and a real restore | Result of a test restore with timings |
| Internet exposure | Ports, admin panels, public storage, certificates | Inventory of what is exposed and what should not be |
| Deployments and secrets | Pipelines, secrets in the code, CI permissions | Location of each exposed secret and a rotation plan |
| Images and dependencies | Image origin, unsupported versions, scanning | Images and components with known vulnerabilities |
| Observability | Alerts, audit logging, retention | Which incidents would go undetected today |
| Continuity | Single points of failure, disaster recovery plan | Estimated recovery time per service |
What does the report look like?
Each risk comes with its priority, the evidence that shows it, a specific recommendation and the estimated effort: S (hours), M (days) or L (weeks). That way you can decide what to close first and what to accept. The report ends with a prioritised improvement plan. You can see the format in the sample audit extract, with made-up data.
How is it done?
Scope
Which environments, accounts and applications are included, and which framework matters to you (ISO 27001, ENS, NIS2 or none). Fixed price before starting.
Read-only access
A named, read-only user with an expiry date.
Review
The seven areas, including a test restore of the backups.
Report and session
Prioritised risks, an improvement plan and a session with your team to answer questions. Within 1-2 weeks of starting.
When we finish, we remove our access and confirm it to you in writing. If you want us to close the risks, it can be done as a project, with a few days of SRE by the day inside your team or as part of SRE as a service.
What experience is behind it?
The person doing the audit has audited other companies’ infrastructure and built secure cloud foundations, and as CTO and head of engineering has been responsible for the security and availability of production platforms. That is why the report separates the controls that genuinely reduce risk from those that only produce paperwork.
Frequently asked questions
Is it an ISO 27001 or ENS certification?
No. We are not a certification body. The audit tells you where your platform stands against the technical controls that ISO 27001, ENS or NIS2 usually require, and what to do to close the gaps, with evidence you can reuse later for certification.
Do you need access to production?
Read-only, named and temporary access to the cloud account and the repositories. If your policies do not allow it, we work from exports and guided sessions with your team.
Do you do penetration testing?
It is not a penetration test. We review configuration, processes and architecture. If you need a penetration test, we recommend commissioning a specialist team and we help you prepare the scope.
How long does it take?
It is delivered in 1-2 weeks, depending on the number of environments and services, and includes a report with a prioritised improvement plan. Beforehand there is a free 20-minute call to set the scope and the fixed price.
Tell us about your case
In a free 20-minute call we look at where you are and where to start. No commitment.
Reviewed on