Service
Application Security & Compliance
Security reviews, hardening and privacy compliance work for Canadian businesses — focused on the risks that actually apply to you.
Reviews that produce fixes, not a PDF
A security report listing forty theoretical findings, ranked by a scoring system nobody on your team can act on, is not much use. We review applications and infrastructure for the issues that are genuinely exploitable in your context, explain what each one would let an attacker do, and then fix them.
In practice the recurring problems are consistent: authentication and access rules that do not hold up when tested directly, secrets committed to a repository, database rules that trust the client, dependencies years out of date, and security headers that were configured on a server the site no longer runs on. None of these are exotic, and all of them are worth more attention than an abstract threat model.
Canadian privacy obligations
If you collect personal information from customers, PIPEDA applies, and provincial legislation may apply on top. That means being able to say what you collect, why, where it is stored, how long you keep it and how someone can ask for it to be deleted — and having a privacy policy that describes what the site genuinely does rather than boilerplate copied from elsewhere.
We align the technical reality and the written policy, which is usually where the gap is. A privacy policy stating that no tracking cookies are used, on a site running three analytics scripts, is a compliance problem as much as a technical one.
What you get
- Prioritised review of the vulnerabilities that genuinely apply to you
- Hardened authentication, access rules and database permissions
- Security headers and content security policy verified on live infrastructure
- Dependency audit with a safe upgrade path
- A privacy policy that matches what your site actually does
Common questions
- How do we know if we have a problem?
- Common signals are an application older than a couple of years with no dependency updates, credentials shared informally between staff, or no clear answer to where customer data is stored. A short review will tell you where you stand.
- Do PIPEDA rules apply to a small business?
- Generally yes, if you collect personal information in the course of commercial activity. The obligations scale with what you collect — a contact form is a much lighter burden than storing payment or health information, but neither is exempt.
Related services
Tell us what you’re trying to build
We’ll give you an honest read on scope, cost and timeline — including whether it’s worth doing at all.