Kept patched, hardened and watched.
We can look after the servers, devices and networks your business runs on: security fixes applied promptly, the usual gaps closed, the local set-up tuned on site, and monitoring agreed with you so problems surface early. The same care we give the software we build.
Four pieces of work, done properly and written down.
Most security problems in small organisations are ordinary: an update not applied, an old account still active, a service left open. We fix the ordinary things first, and tell you in writing what we changed.
-
Patching and updates
We follow security releases for operating systems, runtimes, and the libraries inside the software we build. Updates go on at a time that suits you, usually outside trading hours, and every one is checked afterwards: the service has to respond before we call it done.
-
Hardening
Reducing what an attacker can reach. We review who holds administrator access, switch on multi-factor sign-in where it is missing, remove services nobody uses and close the ports they left open, and check that backups exist and can be restored.
-
Local environment optimisation
On site, we tune the network, devices and servers you already own: Wi-Fi coverage and layout, router and switch configuration, device settings, and the small server in the cupboard. The aim is a set-up that is quicker, simpler and easier to keep secure, without buying things you do not need.
-
Monitoring
We watch the systems we look after for availability, health and waiting updates. When something needs attention it comes to us, and we act on it within the response times set out in your agreement.
How ongoing support is arranged
How we handled the October 2026 security fixes.
Within a day of the 21 Oct PHP and Node security fixes we checked every server we run directly, updated where needed outside trading hours, and confirmed each site responded.
Where a fix depends on another provider or on a client’s maintenance window, we keep it on our list until it is done, and say so.
-
21 Oct 2026
PHP critical security release
Two critical flaws in PHP itself (CVE-2026-109618 and CVE-2026-109619) that can let an attacker run code on a server without signing in. Fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Updating a website or its plugins does not fix it; only the server’s PHP version does. Read the PHP advisory.
-
21 Oct 2026
Node.js security release
The same day, Node.js shipped fixes for ten vulnerabilities, four rated high, across its supported release lines. Read the Node.js advisory.
-
Within a day
Every server we run directly checked
We checked the PHP and Node.js versions on every server we run directly, rather than assuming a host or an automatic update had dealt with it.
-
Outside trading hours
Updated where needed
Where a server needed the fix, we applied it outside trading hours.
-
Afterwards
Each site confirmed
We confirmed each site responded after the update.
Built for our own estate first.
We build the tools we use. One is available on request; the other is how we watch our own systems today.
Launchpad Estate
An on-premise view of an organisation’s IT estate. It is designed to run on your own servers, read your systems through read-only connectors, and make no outbound internet calls unless an administrator switches on a read-only connector to your own cloud services.
Hotspots stay visible until a person clears them, and a fix only clears when the source system observes it. It is set up and run for each organisation, with scope agreed after a consultation.
In-house monitoring
The monitoring we run on our own systems, hosted by us, alongside uptime checks for the sites we run.
It is not on general sale. We mention it so you know what sits behind the way we work.
Agreed in writing, and honest about limits.
Ongoing security work is arranged in writing after a consultation, scoped to the systems you need looked after. It is delivered on a best-efforts basis, with response times set out in writing in your agreement. We do not offer a 24/7 service, and we will not promise one.
The work is led by our founder, who has long experience delivering technology in regulated, high-stakes environments. You deal with the person doing the work.
If you need a platform hosted rather than looked after, our sovereign platforms are available on request. They are designed to be hosted by a UK or EU-owned provider with no US parent, which reduces exposure to US laws such as the CLOUD Act, or run on hardware you own, where requests for your data come to you rather than to a US parent.
Start with a security review.
Tell us what you run and where it lives. We will look at what is patched, what is exposed and what is watched, and give you a written view of what to fix first.