Cloud, DevOps & Care
Security hardening and GDPR, HIPAA and EU Accessibility Act compliance
Sound familiar?
An admin panel open to the internet
Your dashboards sit on public URLs with a password as the only lock. One leaked credential or one brute-force run and someone has your deployments, your database and your customers.
Compliance questions you cannot answer
A European client asks for your GDPR processing record, a US client asks about HIPAA safeguards, and a public-sector buyer asks for an accessibility statement. The honest answer today is a shrug.
Dependencies nobody has updated
The site runs on packages and plugins last updated years ago, with known vulnerabilities listed publicly. Fixing them feels risky, so they stay, and the risk grows every month.
What you get
- Server and app hardening
- Cloudflare Access on admin panels
- Dependency and plugin audit
- GDPR consent and data map
- HIPAA technical safeguards
- WCAG 2.2 AA accessibility fixes
- Accessibility and privacy statements
- Compliance evidence pack
Stack and tools
- Cloudflare Access
- Cloudflare WAF
- UFW and fail2ban
- Docker
- OWASP ZAP
- npm audit and Snyk
- WPScan
- axe-core
- Lighthouse
- Consent management platforms
How we do it
- 1
Audit
We review servers, DNS, applications, dependencies and data flows against OWASP, GDPR, HIPAA Security Rule and WCAG 2.2 AA checklists, and rank findings by risk and effort.
- 2
Harden safely
Fixes ship one at a time with a rollback path: SSH keys only, firewalls, Cloudflare Access in front of admin panels, updated dependencies tested on staging before production.
- 3
Add the controls
Consent banners that actually block scripts, data retention rules, encryption, access logs, keyboard navigation, contrast and screen reader fixes, each verified against the standard.
- 4
Document
You receive a processing record, risk assessment, accessibility statement and an evidence pack with screenshots and configs, ready for clients, auditors and procurement forms.
Standards we work against
- OWASP Top 10 for web applications and OWASP Top 10 for LLM applications
- GDPR Articles 5, 6, 13, 30 and 32 for lawful basis, transparency, processing records and security
- HIPAA Security Rule administrative, physical and technical safeguards
- WCAG 2.2 Level AA as the benchmark for the European Accessibility Act
- Cloudflare Access with identity-provider login in front of every admin panel
- Evidence pack with configurations, scan results and screenshots for audits and procurement
Starting at
from $2,000
Typical timeline 2 weeks. Audit plus hardening for one server and one application. HIPAA programs are scoped after a call.
Related work
Security & Compliance: questions people ask
Further reading
Let's scope your security & compliance project.
Tell us what you are building or what is slowing you down. We reply within one business day.