DevOps Services
Who can still get into your systems?
Old logins, open internal tools, keys in code. We find what we can verify, close it with your approval, and keep checking. Free 48-hour review.
Most teams start with the free AWS bill check. Once the bill is down, we review the rest of your setup for free, and this is one of the things we can take on. How the steps work
The access list nobody has read in two years
You have had a few contractors. An agency built the first version. Someone set up a test account to try a tool and never deleted it. A developer left on good terms last spring. Each of them was given access at some point, and on most small teams nobody took it back.
On top of that, your team now builds internal tools fast, sometimes with AI. An admin dashboard goes up in an afternoon to answer one question, and it is still running months later, reachable by anyone who finds the address.
None of this means you have been hacked. It means there are doors open that nobody is watching.
What could happen
- An old login gets used. A former contractor's password shows up in someone else's data leak, and the account still works on your systems.
- A key in the code runs up a bill. A cloud access key pushed to a code repository can be found by automated scanners within hours and used to start expensive servers or AI workloads overnight. One small team described this happening on Reddit.
- An internal tool shows customer data. A dashboard built in a hurry, or generated with an AI tool, has no login in front of it. Search engines and scanners don't need a link to find it.
- An unpatched server is an easy target. Known holes in common server software get scanned for at scale shortly after they are announced.
- A deal stalls on the questionnaire. A larger customer asks who has admin access, whether two-factor login is required, and how you remove leavers. Guessing the answers is worse than not knowing them.
What we do, step by step
We only report what we can verify. You will not get a scary score or a generic "you're insecure."
- List every way in. Software pulls every user, admin, access key, connected app and open network port across your cloud accounts, code hosting and servers. This is read-only.
- Match it against your real team. A senior engineer goes through the list with you: who is current, who left, which keys belong to which tool. Anything nobody claims is marked for closing.
- Look for exposed keys. Our tooling scans your code repositories, including old history, plus shared configuration, for passwords and keys. A senior engineer confirms each hit is real before it reaches you.
- Find tools open to the internet. With your permission, we check which of your internal dashboards, admin panels and staging sites can be reached without a login. This includes tools built quickly or with AI.
- Harden the servers. Remove password logins where keys should be used, close ports nobody needs, turn on automatic security updates where safe, and put two-factor login on every admin account. Each change comes to you in writing first: what changes, why, and how to undo it.
- Replace what leaked. For each exposed key we help you create a new one, swap it in, and switch the old one off, in an order that doesn't break your app.
- Keep checking. Access reviews on a schedule, alerts on new admin accounts and unusual sign-ins, and spending alerts so a stolen key gets noticed within hours.
What you can do yourself today
- Export the user list from your cloud account, your code hosting and your main admin panels. Compare it with who works with you today.
- Turn on two-factor login for every admin account, starting with your cloud and email accounts.
- Search your code for the words "secret," "password," "api_key" and "BEGIN PRIVATE KEY." Then check old commits too.
- Open each internal tool's address in a private browser window. If you see data without logging in, so does everyone else.
- Set a billing alert in your cloud account at 20% above your normal daily spend.
What's included in which plan
| Guard $700/mo | Watch $1,200/mo | Operate $2,800/mo | |
|---|---|---|---|
| Regular access reviews: who can still get in | Yes | Yes | Yes |
| Locked-down servers and network rules | Yes | Yes | Yes |
| Security monitoring and alerts | Yes | Yes | Yes |
| Software updates, tested before they go live | Yes | Yes | Yes |
| Exposed-key scan and help replacing keys | At setup | At setup | At setup and ongoing |
| Incident handling if something is used | No | No | Yes |
Guard and Watch start with a one-time setup of $1,500. Operate setup is quoted after the free review. Month to month, no exit fee. See all plans.
Questions about security
Are you going to tell us we're insecure and sell us a big project?
No. We report what we found and verified, ranked by how much it matters, with the fix for each. You can do every fix yourselves from the report. If you want help, the price is printed or quoted before any work starts.
Will closing old access break something?
It can, which is why we don't close anything on our own. Unclaimed keys are first switched off where they can be switched back on, and removed only after a waiting period with nothing failing. You approve each step.
Do you help with security certifications or questionnaires?
We give you accurate answers about what is set up in your systems: who has access, how leavers are removed, what is logged. We don't certify you and we don't claim any certification ourselves.
What access do you need to start?
For the free review, view-only access to your cloud account. It lets us read settings and user lists. It cannot change anything, create logins or open your stored files or database records.
How we work with your systems
You stay in control
Read-only access first
The free bill check needs read access and nothing else. Nothing in your systems changes.
You approve every change
Each change comes as a short written note first: what, why, and how to undo it.
Your data and billing stay yours
Everything stays in your own account. We never become your billing contact.
Every action logged
Every action we take is logged, and the log is visible to you.
One-click access removal
Delete the access role and our access ends at once, with no penalty.
Month to month
There is no minimum term and no exit fee. Stop at the end of any month.
Your free AWS bill check, in 48 hours
One read-only template. Every dollar you could stop paying, ranked. You keep the report even if you never hire us.
read-only accessno savings, no feemonth to month
