Cœur de données bleu et violet protégé par plusieurs couches concentriques d’obsidienne et de verre.

Product & software

Infrastructure, hosting, and security

A product that cannot be deployed quickly does not evolve. A product you cannot measure falls without warning. Both problems are treated before the incident, not during.

Start a project See the work

Expertise: Product & software
Deploy: CI/CD · reproducible environments
Hosting: Europe · Docker · managed databases
Security: Auth · secrets · headers · dependencies
Operations: Tested backups · monitoring · alerts

01 / 06

What we put in place

01
Reproducible environments
Development, staging, and production built from the same definition. "It worked on my machine" is an infrastructure symptom, not a developer one.
02
Continuous integration and delivery
Tests, type checks, dependency audit, and automated release. Deploying must be a non-event: that is the condition for fixing fast when you must.
03
Authentication and access
Sessions, tokens, two-factor authentication, explicit roles and permissions. Authentication is designed as a product feature, with its error journeys — not a box ticked at the end.
04
Secrets and data
Keys out of the repository, encryption at rest and in transit, access isolation, personal data minimised. GDPR is treated in the data model, not on a legal page.
05
Verified backups
A backup never restored is not a backup. We define frequency, retention, and acceptable recovery time, then we actually test the restore.
06
Observability
Usable logs, error reporting, metrics, and alerts on what deserves a wake-up. Too many alerts is exactly the same as no alert at all.

02 / 06

The baseline applied to every site and application

Deploying must be a non-event: that is the condition for fixing fast when you must.

Strict HTTPS, security headers, and a content security policy that is actually restrictive.
Form protection against bots and abuse, without degrading the experience.
Dependencies followed and updated, with an automatic audit on every deploy.
Role isolation and least privilege on administrator access.
Logging of sensitive actions, so you can answer "who did what".
A written incident procedure: who to tell, what to cut, how to roll back.

03 / 06

Taking over existing infrastructure

Many projects arrive with a history: a server configured by hand years ago, a deploy only one person knows how to run, backups nobody has checked.

We start by documenting what exists and securing what must be secured immediately — access, backups, critical updates. Modernisation comes next, in stages, without downtime.

The goal is never the most elegant infrastructure: it is the one your team can run without us.

Proof in context

See the work behind this expertise

Product, architecture, and operations choices, explained on real studio projects.

Case studyCréarègleA rebuild of a tracing-tool and scrapbooking shop as a headless architecture: Next.js storefront, custom back-office, and Medusa backend, ready to replace WooCommerce without losing earned search ranking.Architecture, development and infrastructure

05 / 06

What we get asked most

The answers we give anyway at the first conversation.

Do you host the sites you build?

Yes, or we deploy at the host of your choice. In both cases the configuration is described in the repository: you can leave without rebuilding anything.

Where is the data hosted?

In Europe by default, with hosts that document location and processing. For sensitive or health data, we scope hosting requirements before any technical choice.

What happens if it goes down?

It depends on the commitment retained. The baseline includes monitoring, alerts, and a documented recovery procedure. A restoration-time commitment is contracted separately, with the matching means.

Do you run security audits?

We review configuration, dependencies, and code on the applications we operate or take over. A full penetration test belongs to a specialised vendor, whom we can point you to.