Services: infrastructure and security
The groundwork that keeps your agents auditable.
We apply the same discipline here as on our own production stack. There are two engagements: production server hardening on Linux and Windows, and secure AI routing, which lets your engineers use agentic CLIs while your data stays out of a vendor's public endpoint.
Server hardening for Linux and Windows
CIS Benchmark hardening for production servers, as a sprint or under a small monthly retainer.
Scope
OS hardening to the relevant CIS Benchmark: Ubuntu LTS, RHEL and Debian on Linux, and Windows Server 2019 and 2022 on Microsoft. It also covers service-account hygiene, sudoers and RBAC review, SSH and RDP lockdown, host firewall posture and AV/EDR alignment.
Patch cadence
Monthly patch windows, with security-advisory triage between them. Kernel, runtime and dependency updates go out with a backup before, a smoke test after and a documented rollback path. Nothing your revenue depends on gets patched silently.
Log forwarding and visibility
syslog and Windows Event Log forwarding to your SIEM, or one we set up. Authentication events are covered on both sides. Retention is set by class, so security events stay longer than housekeeping noise. You can audit from a workstation as well as the SIEM console.
Identity and segmentation
Directory-joined where that makes sense, and local accounts with clear rules where it doesn't. Network segmentation at the host firewall and the cloud subnet. Least privilege by default, admin paths fenced and logged, and emergency break-glass documented.
Engagement shapes
A single hardening sprint, typically two weeks per ten or so hosts, with a written report and a remediation log. Or a small retainer, with a monthly patch window and a quarterly review against drift. We'll recommend one during the diagnostic.
Secure AI routing
Route agentic CLI sessions and API calls through your own perimeter: server, VPN, egress controls and audit log.
The problem
Your engineers want Claude Code, Codex CLI and Gemini CLI. Your data classification doesn't allow code or context to leave the building through a vendor's public endpoint without controls. You can solve that without banning the tools, using plumbing you operate.
What we ship
A routing server you operate, between developer machines and the model vendor. It is VPN-fronted and egress-controlled, with full request and response audit logging. You set the policy on approved tools, domains and working hours, and it's enforced on the wire.
What stays the same
Claude Code, Codex CLI and Gemini CLI work the way your engineers already know them, with no bespoke wrapper, no second IDE and no middleware shrinking the context window.
What it doesn't claim
It doesn't run an LLM in your VPC, and it doesn't guarantee how the model vendor handles data. It gives you the perimeter, the plumbing and the audit trail you need to use vendor models responsibly under PDPA-class data controls.
Engagement shape
A two-to-four-week setup, with a runbook and a small operations retainer for the first quarter. After that, your team operates it and we're on call.
Brief us
Tell us about
your estate.
The diagnostic week is paid up front and produces a written scoping report: a host inventory and remediation backlog for hardening, or a network and policy diagram for routing. You keep the report whether or not we run the engagement.
Brief us