Get a quote

Security

Most of the work happens below the waterline.

Visitors only see your pages. Underneath, every Rogueberg site sits on five layers of protection that we set up, test and watch for as long as we host it.

    • TLS 1.3 and HSTS
    • web application firewall
    • DDoS filtering
    • rate limits on logins and forms
    • bot management

    • Input validation
    • CSRF protection
    • Content Security Policy
    • two-factor login for admins
    • dependency scans for known CVEs

    • Minimal Linux install
    • key-only SSH, root login off
    • default-deny firewall
    • automatic security updates
    • brute-force blocking

    • Encryption in transit and at rest
    • separate databases for sensitive records
    • least-privilege access
    • nightly encrypted off-site backups
    • restore tests

    • Uptime checks every minute
    • intrusion and malware alerts
    • log review
    • certificate expiry alerts
    • monthly security report

Pre-launch checklist

Nothing goes live until every box is ticked.

We run the same checklist on every project, from a six-page startup site to a university portal. You get a signed copy at handover.

  • All traffic forced to HTTPS with HSTS
  • Security headers and CSP in place
  • Admin areas behind two-factor login
  • No default passwords or shared keys
  • Forms and logins reviewed against the OWASP Top 10
  • Dependencies scanned for known CVEs
  • A backup restored to a test server
  • Alerts tested end to end

If something goes wrong

You hear it from us first, with a plan.

  1. 1 · Detect

    Automated alerts reach an engineer the moment a check fails or something unusual appears in the logs.

  2. 2 · Contain

    We isolate the affected part, block the source and protect your data before anything else.

  3. 3 · Restore

    We fix the cause and bring the site back from a clean, tested backup if needed.

  4. 4 · Report

    You get a written report: what happened, what we changed, and anything you need to file with regulators.

Built with the rules your organization answers to.

We design systems that make compliance easier. Formal certification and legal advice remain with your auditors and lawyers.

India

DPDP Act, 2023

Consent notices, parental consent for minors, and data you can find, export and delete on request.

India

CERT-In directions

Logs retained and incident details ready, so reportable incidents can be filed within the required 6 hours.

European Union

GDPR

Cookie consent that works, EU hosting when needed, and privacy pages that match what the site really does.

Worldwide

OWASP Top 10

Every form, login and API checked against the most common web application risks.

Worried about your current site?

We'll review it and tell you plainly what needs fixing, whether or not you hire us.

Request a security review