Case study · Cloud and cybersecurity
We did not build it. We took it to production, secured it and ran it.
An entrepreneurship organization had a founder test built by a third party, running on a prototyping platform, with a QR code already printed and in circulation. We took over hosting and security: we migrated it to a cloud we manage, closed the gaps and kept it stable until the campaign ended.
The campaign in numbers
The app worked and the QR code was already printed, but it ran on an environment meant for prototypes: no backups, no deletion protection, database permissions wider than needed and more connections than the database could handle at peak.
We migrated the app to a cloud we manage, redirected the existing QR without breaking links or campaign analytics, set up a custom domain with an automatic certificate, left the database on least privilege with automatic backups, and tuned capacity for event peaks.
The whole campaign ran on the new infrastructure at roughly 28 USD a month. When it ended we delivered a verified backup of everything and shut the resources down so the client stopped paying.
Same app, same QR code. What changed was everything holding it up.
Printed QR code in circulation
Prototyping platform
Database with personal data
Untuned capacity
The same QR, redirected
Custom domain with automatic TLS
Container on Cloud Run
PostgreSQL 17 on Cloud SQL
Guards around it
Client under a confidentiality agreement. The app belongs to a third party, so we do not show its screens here.
Concrete controls for an app with personal data and event traffic.
The app connects with a role that can only read and insert. It cannot delete or change existing data.
Credentials live in Secret Manager and environment files are excluded from the repository and the images.
Automatic backups with 30 retained, a verified manual backup and deletion protection on the instance.
We audited permissions, costs and failures in the previous setup, and verified every finding before acting.
HTTPS with a managed, auto-renewing certificate, with the campaign served from a domain under our control.
An instance cap and a budget with alerts: a traffic spike or an attack does not turn into a surprise bill.
While taking it to production we found and fixed two issues affecting operations: a connection leak that could take the service down, and a double submit that left users stuck right after answering all 28 questions.
When the campaign ended we did not just switch it off. We delivered a complete, verified package so the client can restore the service whenever they want, on this cloud or another, and then shut the resources down.
We host it, secure it and run it, whether we built it or not.