What we hold, what we run, and how to check
Badges are easy to print. This page lists the platforms we are certified to design and operate, the standards we work to, the targets we sign, and the questions you should ask any provider before trusting them with your business. We answer all of them in writing. For where we stand on company-level certifications such as SOC 2 and ISO 27001, see the Trust Centre.
Platforms we are certified to run
The technology behind the service, and what we do on each. Our engineers hold current vendor certifications on these platforms. We list individual credentials by engineer in proposals rather than here, because certifications belong to people and roles change.
Microsoft 365, Azure, Entra ID, Intune, Defender and Purview
Singularity endpoint protection, operated by our SOC
FortiGate, FortiSwitch, FortiAP and Secure SD-WAN
Next-generation firewalls and Panorama
Switching, wireless and SD-WAN
Sophos Firewall and Intercept X through Sophos Central
Landing zones, workloads and immutable backup targets
Workloads and Google Workspace security
Satellite failover and connectivity for remote sites
Standards we work to
A framework is only worth naming if it changes what happens in your environment. This is how each one shows up in the work.
Every service in our catalogue is mapped to a framework function, and quarterly posture reviews are scored against it.
Configuration baselines for Microsoft 365, Azure, AWS, Google Cloud, Windows and network equipment.
Canada's federal privacy law and BC's provincial law. We run our own privacy programme under both and help clients meet them.
Control design, implementation and evidence collection for clients working towards a report or certificate.
Scoping, segmentation, hardening and evidence for clients who take card payments.
US health-data safeguards and agreements for Canadian clients with US patients or partners.
Service level commitments
Our standard targets, written into every managed agreement. Attainment against them is reported to you monthly; the full priority table and escalation path are on the Services page.
How to verify us: six questions for any provider
Ask us all six, then ask the other providers you are considering. The answers tell you more than a wall of logos ever will.
An on-call engineer with the security operations centre behind them. A critical incident is acknowledged within 15 minutes, any hour, with updates every 30 minutes until it is contained.
Tickets by priority with response attainment, patch compliance, backup success, agent coverage, posture score and open risks. A redacted sample is available on request.
Restore tests run quarterly at file, system and site level, timed against your recovery objectives. The date and timing of the last test are in every monthly report.
They are yours. Asset inventory, diagrams, runbooks and credentials are handed over in full with a transition plan. We do not hold clients by holding their keys.
The ten baseline controls are included for every managed client. The services catalogue states what each service includes, so the scope is in writing before the price is.
Yes, with that client's permission. We arrange references rather than publish names, and we will tell you if we have not worked in your sector yet.