How we work

The engagement, step by step

1. First call. You write to us. An engineer replies within one business day. If it helps, we have a short call (about 30 minutes) to understand your setup, your deadline and what worries you.
2. Fixed-scope quote. You get a written quote: what we will do, what we will deliver, how long it takes and what it costs. Prices are published as starting points on our pricing page. The quote does not grow by the hour.
3. Work you can see. We work in Git, in your repositories, through pull requests. You can read every change, the reason for it and the checks it passed. Nothing is changed on your production systems by hand.
4. Findings come with fixes. An audit does not end with a list of problems. Each finding has a risk level and a concrete fix, and where the scope includes it, we apply the fix with you.
5. Handover. You get documentation written for the people who will run the system, access is moved to your team, and any credentials we used are rotated.
6. Optional care plan. If you want us to stay, a monthly plan covers monitoring, updates, backup checks and help with changes. If you do not, you are fully independent.

Delivery controls on every engagement

These controls apply to every system we touch, whether it is a bank’s infrastructure or a small online shop.

• Every change goes through Git and a pull request. Nobody edits production by hand.
• Automated checks before merge: syntax for the server’s runtime version, a scan for secrets and forbidden files, and a flag on risky changes (configuration, CI, dependencies, SQL, data-deleting code).
• Staging on sanitised data. Payments, analytics, email and social login are off, and domains are rewritten.
• A production gate on the server itself, so a pull request cannot weaken it. A deploy goes ahead only if the commit is on master and fast-forward, it came through a reviewed pull request and CI is green. A database backup is taken first, and a health check runs afterwards with automatic rollback.
• A nightly drift check compares production with Git and opens an issue if something changed outside the pipeline. Deploys stay blocked until it is resolved.
• Backups are encrypted and go to separate storage: the database every 6 hours and files nightly, with restores tested and verified by checksum.
• Removed files go to quarantine, not straight to deletion.
• Least privilege. Deploy keys are read-only and per repository. CI deploy keys are pinned to a forced command, so a leaked key can only redeploy.

How we use AI agents, and where we stop

We use AI agents (Claude) in our own work: to read unfamiliar code, draft changes, write tests and documentation. It makes us faster.

The limits are strict:

• the agent works only through pull requests;
• it never has server, database or secret access;
• it never merges with red checks;
• an engineer reviews and is responsible for every change it proposes.

Communication

• Languages: English, Spanish, Ukrainian and Russian.
• Response time: an engineer replies within one business day.
• No sales layer. You talk to the engineers who do the work.
• Written by default. Decisions, findings and changes are written down in pull requests, issues or short reports, so nothing depends on someone’s memory of a call.

What we don’t do

• No hourly surprises. The price is in the quote. If something outside the scope comes up, we tell you and you decide.
• No lock-in. Code, servers, domains and accounts stay yours. We do not hold anything back that you would need to work with someone else.
• No unreviewed changes to production, by us or by our tools.
• No certificates we cannot give. We implement controls for PCI DSS, DORA and NIS2. We are not a QSA or an accredited TLPT provider, and we do not certify anyone.

For how we protect your systems and data while we work with them, see Security & trust.