Do we have to be in the cloud?

No. On your own hardware, in a cloud, or a mix of both; the review and the blueprint cover whatever you actually run.

Is this a penetration test?

No. It is the review and the fixes. Once the estate is in order we can arrange an independent penetration test, which is worth far more against a hardened system than against one with the defaults still on.

We already have an IT company.

Good. We work alongside them: the blueprint and the runbook are written for whoever runs the systems, including them.

Does this cover PDPL?

Yes. The review includes a personal-data register, and the blueprint records where that data is hosted, who reaches it and how long it is kept, so the estate meets the Personal Data Protection Law without a separate project. The policy wording stays with you or your counsel; we make the systems match it.

Services (05)

Security & Systems Architecture

Your servers, network and services reviewed, hardened, patched and written down — a blueprint of how it all fits, and someone who keeps it that way.

⃁ quoted in writing after a two-week review

Start a conversation (Or on WhatsApp)

Not sure yet? Check your site first, free.

Review
Admin two-factor
Patch window

(01)

Two weeks of reading before anything is touched

The review is an inventory first: every server, service, open port, user, certificate, scheduled job and backup, and who can reach which of them from where. Most of it is done read-only, from the console and the configuration, with the people who run it in the room. Nothing is changed in those two weeks.

It ends in a written document you own: what exists, what is exposed, what is unpatched, what has no backup, and what we would do about each, ranked by the damage it could do rather than by how interesting it is.

What a review of a typical estate turns up

Servers and services
Ports open to the world
Unpatched over 90 days
Accounts without two-factor
Backups never restored

(02)

The blueprint

A drawing of the architecture as it is and as it should be: what sits at the edge, what is public, what is internal, where the data lives, where the backups go and how an administrator gets in. Segments with firewalls between them, so a compromised web server cannot see the accounts database, and a lost laptop cannot see anything.

The blueprint is the document every later decision is checked against. When someone wants to add a service, it says where it goes; when something breaks at two in the morning, it says what talks to what.

The segments, edge to backup — the gaps are the firewalls

Edge
Public services
Internal services
Data
Backups
Management

(03)

Patched, hardened, and kept that way

Operating system patches within seven days of release, dependency updates weekly after a staging run, certificates renewed by a job rather than a reminder, and the defaults that ship on turned off: password sign-in over SSH, services listening on every interface, database ports open to the world.

On retainer this becomes a calendar rather than a project: the patch window every week, a full review every quarter, and a report that says what was found and what changed.

A year on retainer — patch windows every week, a full review every quarter

(04)

Who can reach what

Two-factor sign-in on every account with no exception for the boss, administrator rights on separate accounts nobody reads mail from, shared passwords replaced by a vault, and access granted by role rather than by whoever asked last. A leaver loses every key the same hour, from one list.

None of this needs new products. It needs a list of who has what, a decision about who should, and an afternoon of settings. Most estates we review have never had the list.

Access on arrival, and after — the accent bar is after

Admin accounts with two-factor
Access granted by role
Passwords in a vault
Shared accounts
Ports open to the world

(05)

Personal data, under the Kingdom's law

Saudi Arabia's Personal Data Protection Law (PDPL) has been in force since 2023 and enforced by SDAIA since September 2024, and it applies to every business that holds a customer's name, phone number or ID, not only to banks and hospitals. It asks for things most estates have never written down: a record of what personal data is held and why, a privacy notice that says so, consent or another lawful basis for each use, a retention period, a way for people to ask what you hold on them, and a report to the regulator within seventy-two hours of a breach.

We map it onto the blueprint: which systems hold personal data, where they are hosted and whether that is inside the Kingdom, who can reach them, how long records are kept and how they are deleted. Transfers outside Saudi Arabia are listed and justified or stopped. The result is a register and a set of settings rather than a binder, and it is checked again at every quarterly review. We are engineers, not lawyers: the policy wording is yours or your counsel's; the systems that make it true are ours.

The PDPL register, item by item — the accent bars are the ones most estates are missing

Record of processing
Privacy notice and consent
Hosted inside the Kingdom
Transfers outside Saudi Arabia
Retention and deletion
Breach reported to SDAIA

(06)

When something happens

Monitoring that reaches a pager, an incident runbook written before the incident, and backups that have been restored on a schedule so the restore time is a number rather than a hope. When the alert fires, the first hour is already decided: who is called, what is isolated, what is restored from where.

Afterwards there is a written account of what happened, what was changed so it does not happen twice, and what it cost, in plain language a board can read.

The first hours — what happens, and by when

Detected
Contained
Restored
Written up

Questions we get asked

Do we have to be in the cloud?: No. On your own hardware, in a cloud, or a mix of both; the review and the blueprint cover whatever you actually run.
Is this a penetration test?: No. It is the review and the fixes. Once the estate is in order we can arrange an independent penetration test, which is worth far more against a hardened system than against one with the defaults still on.
We already have an IT company.: Good. We work alongside them: the blueprint and the runbook are written for whoever runs the systems, including them.
Does this cover PDPL?: Yes. The review includes a personal-data register, and the blueprint records where that data is hosted, who reaches it and how long it is kept, so the estate meets the Personal Data Protection Law without a separate project. The policy wording stays with you or your counsel; we make the systems match it.

Riyadh, Saudi Arabia

The coffee is on us.

Tell us about the site or the idea, in Arabic or English, and we will come back with questions, then a number in writing. No deck, no pressure, and the first conversation costs nothing.