Error: a customer asked for SOC 2
A larger client wants a SOC 2 report or a security questionnaire, and you are not ready.
) protect · security & compliance
Cybersecurity Services for the Websites and Apps You Run
Security and compliance for growing companies whose website, platform or app holds customer data. We find your weak points, fix them, prepare you for audits like SOC 2 and keep watch so small issues do not become incidents.
// overview
What our cybersecurity services cover
Our cybersecurity services protect the websites, web applications and cloud systems your business runs. They cover security audits, vulnerability scanning, penetration testing, SOC 2 readiness, privacy compliance, web application firewalls, DDoS protection, malware removal and incident response.
Most breaches of company websites and apps come from familiar gaps: outdated software, weak access controls, exposed data and misconfigured cloud services. Finding and closing them is the first job.
Security sits alongside our DevOps, cloud and maintenance work, so fixes get shipped, not just reported.
// sound familiar?
Signs your security needs attention
Gaps we find most often.
Warning: never tested
Your app has never had a penetration test or vulnerability scan.
Error: site hacked or blacklisted
Malware, spam pages or a browser warning on your website.
Warning: shared logins
Admin accounts are shared and nobody uses two-factor authentication.
Error: misconfigured cloud
Public storage buckets, open ports or overly broad permissions.
Warning: no incident plan
Nobody knows who to call or what to do if something happens.
// what's included
Our security and compliance services
Practical security for growing companies.
Security Audit
A review of your website, app, cloud and access controls with prioritised fixes.
Vulnerability Assessment
Regular scanning of your sites, apps and servers for known weaknesses.
Penetration Testing
Web application and API penetration testing that shows how an attacker would get in.
SOC 2 Readiness
Gap assessment, policies and technical controls to prepare for a SOC 2 audit.
Privacy Compliance
PIPEDA and HIPAA basics for the systems that handle personal data.
WAF & DDoS Protection
Web application firewall and DDoS protection at the edge.
Malware Removal
Clean up hacked websites and close the hole they came through.
Incident Response
Help to contain, investigate and recover when something goes wrong.
// free · confidential
Get a free, confidential security check
Send us your website or app. We will run a light external check and send back the most important issues — privately, and with no obligation.
01Assess
Security audit, scans and, where needed, a penetration test.
→ findings report
02Prioritise
Rank issues by risk and effort, with clear owners.
→ remediation plan
03Fix
Patch, harden and reconfigure — with your team or ours.
→ fixes shipped
04Prove
Re-test, document controls and prepare evidence for audits.
→ evidence pack
05Monitor
Ongoing scanning, alerts and periodic reviews.
→ monthly report
// how we measure
Security results we report on
We agree these measures with you at the start and report on them in plain language.
01
// critical issues closed
02
// time to fix
03
// audit readiness
// a typical challenge
SaaS company asked for SOC 2 by an enterprise prospect.
// how we approach it
Gap assessment, access controls, logging, policies and a penetration test.
// what we report
Progress against the measures above, every month, in plain language.
// who it's for
Who our security services are for
Companies whose customers trust them with data.
SaaS & Software
Products that need SOC 2 and security questionnaires to close larger deals.
Ecommerce
Stores handling customer and payment data.
Health, Finance & Professional
Firms with privacy obligations.
Business Websites
Sites that need hardening, monitoring and malware protection.
Frameworks and tools we work with
- OWASP Top 10
- SOC 2
- PIPEDA
- HIPAA
- Cloudflare
- AWS Security Hub
- Burp Suite
- Vanta / Drata
// compare
Choosing a cybersecurity partner
How we compare with the usual options.
| Feature | tech pumpkin | Large security firm | Automated scanner only |
|---|---|---|---|
| Fixes shipped, not just reported | ✓ Developers on the team | Report only | ✕ |
| Web app and cloud focus | ✓ | ✓ | Partial |
| SOC 2 readiness support | ✓ | ✓ | ✕ |
| Sized for growing companies | ✓ | Enterprise focus | ✓ |
| Penetration testing | ✓ | ✓ | ✕ |
// go deeper
Security and compliance guide
Short answers to common questions.
What is SOC 2 compliance?
SOC 2 is an audit standard that shows a company protects customer data according to five trust criteria: security, availability, processing integrity, confidentiality and privacy. A Type I report checks controls at a point in time; a Type II report checks them over several months.
What is the difference between a penetration test and a vulnerability scan?
A vulnerability scan is an automated check for known weaknesses. A penetration test is a hands-on attempt to exploit weaknesses and show real impact. Scans should run regularly; penetration tests are usually yearly or after major changes.
How do you know if your website has been hacked?
- Browser or Google "deceptive site" warnings
- Unknown pages, links or redirects
- New admin users you did not create
- Sudden traffic drops or spam in search results
- Hosting provider warnings
// faq
Cybersecurity services FAQs
Common questions about our security and compliance services.
What do cybersecurity services include?
Our cybersecurity services include security audits, vulnerability assessments, penetration testing, SOC 2 readiness, privacy compliance, WAF and DDoS protection, malware removal and incident response for websites, apps and cloud systems.
How much do cybersecurity services cost?
The cost depends on what needs protecting, the depth of testing and your compliance goals. After a free security check we send a written scope and estimate.
Do you offer penetration testing?
Yes. We test web applications and APIs and report findings with clear fixes, then re-test once they are resolved.
Can you help us get SOC 2 compliant?
Yes. We run a gap assessment, put the technical controls and policies in place and prepare evidence for your auditor. The SOC 2 report itself is issued by an independent CPA firm.
Do you help with PIPEDA and privacy compliance?
Yes. We review how your systems collect, store and protect personal data and help close the gaps.
Can you fix a hacked website?
Yes. We clean the site, close the vulnerability and help get it off blacklists. See website maintenance for ongoing protection.
// let’s lock it down
Ready to close your security gaps?
Tell us what you need to protect. Everything you share stays confidential — no obligation.
- 01Discovery call — your setup, risks and goals
- 02Written plan and scope
- 03Onboarding with your support team