Cloud & server security
We pick the cloud to fit the job, not the other way round. A government system that has to stay in the country, a SaaS that needs to scale in a hurry and an internal tool that should cost twelve dollars a month all need different answers. We design the setup, write it as code, and leave you with infrastructure your own team can read.
01In detail
What we do
Architecture & platform choice
AWS, Google Cloud, Azure or DigitalOcean, chosen on cost, data-residency rules and what your team can realistically run. Sometimes the answer is two of them.
Migrations
From shared hosting, on-premise servers or another cloud, with a rehearsed cutover and a rollback plan nobody hopes to use.
Infrastructure as code
Terraform and Ansible, so every server, network rule and permission is reviewed, versioned and reproducible.
Containers & Kubernetes
Docker wherever it helps. Kubernetes (EKS, GKE, AKS or DigitalOcean) only where it pays for the complexity it adds.
CI/CD & environments
Pipelines that test, scan and deploy on every merge, and a staging environment that actually matches production.
Cost & reliability
Right-sized instances, reserved pricing, storage clean-up, plus backups that have been restored and alerts that reach a person.
02Process
How it runs
Cloud accounts are opened in your name and billed to you. We get access, not ownership, so you can change providers or partners whenever you like.
Review
1 week
We map what you run today, what it costs each month and where it is likely to fail, and write it all down.
Design
1 – 2 weeks
Target architecture, security model and a migration plan, with a monthly cost estimate you can take to finance.
Build & migrate
Staged
Infrastructure written as code, environments stood up, data moved in rehearsed steps with a rollback at every one.
Run
Monthly
Patching, monitoring, cost reviews and support under a written agreement, with a short report every month.
03Deliverables
What you get
- Infrastructure defined in Terraform, in your repository
- Architecture diagram and runbooks for common incidents
- A backup and restore procedure that has been tested
- Monitoring, alerting and a monthly cost report
- Cloud accounts and credentials owned by you
Tools we reach for
- AWS
- Google Cloud
- Azure
- DigitalOcean
- Terraform
- Ansible
- Docker
- Kubernetes
- GitHub Actions
- Linux
Security checks
Six security checks before every launch.
Before anything goes live, we test it the way an attacker would, then write down what we found and how we fixed it. The same six checks run on every project, from a one-page website to a government portal.
- 01
Scan for known weaknesses
We check your code, the libraries it uses and the server for weaknesses attackers already know how to exploit.
OWASP Top 10 · CVE database
- 02
Try to break in
Our engineers attack it the way a real attacker would: logins, permissions, file uploads, pages that should be hidden.
OWASP ASVS
- 03
Check every public link
Every public page and address is crawled for files, folders and test pages that should never have been online.
OWASP Top 10
- 04
Look for malware
The code, the server and anything users can upload are checked for malware and hidden backdoors.
Before every launch
- 05
Try to trick the AI
For AI agents, we try to make them leak data, ignore their instructions or use access they should not have.
OWASP Top 10 for LLM Applications
- 06
Write it all down
Every finding, how we fixed it and the re-test that proves it, in a report your auditors can read.
ISO/IEC 27001-aligned process
Our process follows ISO/IEC 27001 controls. Prospiral is not ISO certified. VAPT means vulnerability assessment and penetration testing: the first two checks above.
05Questions
Questions we get asked
It depends on where your data has to live, what your team already knows and your budget. DigitalOcean is often enough for a young product. AWS, Azure or Google Cloud make more sense when compliance, scale or an existing contract points that way.
Usually. Idle instances, oversized databases, forgotten snapshots and missing reserved pricing are common. You get a list of savings with estimates before we change anything.
No. A lot of our infrastructure work is on systems built by others, including older PHP applications that need a safer home.
Start a conversation
Tell us what’s broken.Or what you want built.
Send a few lines about the system or the idea. One of the engineers who would actually do the work will reply, usually within a working day.