Client stories from recent engagements

The secure architecture review caught an assumed trust between our billing worker and the customer API that none of our sprint boards had named. We delayed one release and closed the path before launch.

Softgategrid’s cloud control-plane assessment was blunt about our break-glass accounts. Useful, though the remediation list was longer than our platform team could finish in one quarter — we had to sequence hard.

Client in digital health — the incident readiness drill exposed that our on-call runbook still pointed at a retired Slack channel. Awkward for thirty minutes, then permanently fixed.

We hired Softgategrid for an application hardening sprint on session handling. Pairing days were dense; the written notes were specific enough that juniors could continue without re-explaining the threat model.

Rated the engagement 4/5 — strong on architecture clarity, slower than hoped on scheduling the final briefing across time zones.

Case note: trust path before launch

A London fintech team booked Softgategrid’s secure architecture review three weeks before a regulated feature release. The workshops identified an internal worker that could call a customer-facing API with broader privileges than the product model required. Remediation delayed the release by five days and removed the path. The mild cost was calendar tension; the gain was a launch without an unspoken privilege.

Case note: drill that found a dead channel

During an incident readiness drill for a digital health client, the facilitator asked the on-call lead to escalate using the published runbook. The Slack channel named in the document had been archived months earlier. The after-action note made channel ownership part of the change checklist for every future runbook edit.