About Services Products Team Insights

What we do.

Each area is scoped and delivered on its own. Most engagements combine two.

Custom SaaS developmentWeb platforms & dashboardsCybersecurity & VAPTCyber auditsBusiness automationSystem builds & adaptation

01 / 06

Custom SaaS development

Software specified to the process, not the other way round.

Product strategy / MVP to scale / API-first / Multi-tenant architecture / Ongoing operation

Product built around your process rather than the reverse: specified with the people who will use it every day, then designed, built and run. Multi-tenant where that helps, single-tenant where the data says otherwise.

What it covers

Product discovery and specification with the people who will actually use itMVP and early-stage build for founders validating a new productMulti-tenant architecture for products sold to many organisationsSingle-tenant builds where data segregation requires itAPI-first development, built for integration from day oneSubscription billing and payment infrastructure integrationThird-party integrations CRM, ERP, payment gateways, identity providersRe-architecture and scaling of a product that has outgrown its buildCI/CD pipeline setup and release engineeringOngoing operation, monitoring and iteration after launch

02 / 06

Web platforms, dashboards & work-control systems

The tools your team actually runs the business on.

Internal dashboards / Admin & back-office / Work-order systems / Real-time monitoring / Role-based access

Not a marketing site, and not a template. This is backend-heavy software your own people use to see, control and record what is happening: internal dashboards, admin systems, work-order and field-operations tools, built to the workflow rather than fitted to a theme.

What it covers

Internal operations dashboards and business-intelligence viewsAdmin panels and back-office systems for day-to-day operationsWork-order and field-service control systems: dispatch, status, sign-offReal-time monitoring and control interfaces for live operationsMulti-role, multi-permission access systemsCustom reporting layers over existing data sourcesExecutive reporting and data-visualisation interfacesLegacy back-office UI modernisation without disrupting the system beneath itScoped-access portals for clients, vendors or contractorsIntegration of the dashboard layer with existing operational systems

03 / 06

Cybersecurity

Defence built for the system you actually run.

VAPT / Threat modelling / Cloud security / Incident response / DevSecOps

Security specified against your real architecture rather than a generic checklist: threat modelling, hardening, testing and response, for systems Dunime built and systems it did not. Decided alongside the feature, not bolted on afterward.

What it covers

Vulnerability assessment and penetration testing (VAPT) across web, mobile, API and networkThreat modelling at the design stage, before code is writtenSecurity architecture and secure code reviewCloud security posture review (AWS / Azure / GCP)DevSecOps security checks built into the CI/CD pipelineRed-team and adversarial simulation exercisesIncident response planning and active incident supportSecurity monitoring and alerting setupEmployee security-awareness training and phishing simulationAlignment work toward recognised frameworks such as ISO 27001 and OWASP ASVS

VAPT, in detail

A vulnerability assessment finds what is exposed. A penetration test proves what an attacker could actually do with it. We run both, by hand as well as with tooling, against the scope you agree and under written rules of engagement.

What we test

Web applications Authentication, session handling, access control, injection and business-logic flaws.Mobile applications Android and iOS: local storage, transport security, reverse engineering and the APIs behind the app.APIs REST and GraphQL: object-level authorisation, rate limiting, excessive data exposure.Network & infrastructure External perimeter and internal network: exposed services, segmentation, privilege escalation.Cloud AWS, Azure and GCP: identity and access, storage exposure, misconfiguration.

How much we know going in

Black box No prior knowledge. The view an outside attacker has.Grey box Limited credentials or documentation. The view of a user, partner or insider.White box Full access to architecture and code. The deepest coverage per day of testing.

How a test runs

Scope and rules of engagementTargets, testing windows, contacts and limits agreed in writing before anything is touched.
ReconnaissanceThe attack surface mapped the way an attacker would see it.
AssessmentAutomated scanning, then manual testing to confirm and extend what the scanners find.
Controlled exploitationImpact proven without damaging data or availability.
ReportingEvery finding with evidence, a CVSS severity and a fix your team can apply.
RetestVerification once remediation is done, closed out in writing.

What you receive

Executive summary Risk in plain language, for leadership and the board.Technical report Proof of concept, severity and remediation for each finding.Retest report What has been closed, and what remains open.

Tested against OWASP Top 10, OWASP ASVS and MASVS, PTES and NIST SP 800-115. Severity scored with CVSS. Incident response plans are written around CERT-In's direction to report specified cyber incidents within six hours of noticing them.

04 / 06

Cyber audits

Evidence, not opinion.

Security audit / Compliance readiness / Configuration review / Board-ready reporting / Post-incident review

A distinct engagement from active testing: a documented, evidenced read on where an organisation stands, in language a board or a regulator can act on. Kept separate from Cybersecurity by design, because an audit that marks its own work is not independent.

What it covers

Information security audit and gap assessment against a named frameworkCompliance-readiness audits (ISO 27001, SOC 2, PCI-DSS)Data-protection compliance review (GDPR, DPDP Act, CCPA, as applicable)Cloud configuration and access-control auditSource-code security audit, independent of the build teamIT general controls (ITGC) audit for finance and operations systemsThird-party and vendor security-risk auditPost-incident forensic audit and root-cause reportingBoard- and regulator-ready audit reportingFollow-up verification once remediation is complete

An audit, in detail

Framework and scopeThe named standard, the systems and the period under review, agreed at the start.
EvidencePolicies, configurations, logs, interviews and samples, collected and referenced.
Gap assessmentEach control rated against the framework, with the evidence behind the rating.
ReportFindings prioritised by risk, in language a board or a regulator can act on.
Follow-upVerification once remediation is complete.

Frameworks we audit against

ISO/IEC 27001SOC 2PCI-DSSGDPRDPDP Act 2023CCPAITGC
05 / 06

Business automation

Take the repeatable work off human hands.

Workflow automation / RPA / Document processing / System integration / AI-assisted automation

Workflow and process automation for the parts of an operation that run the same way every time and should not need a person to run them manually, from approval routing to document processing to system-to-system integration.

What it covers

Workflow automation approvals, task routing, notifications, escalationsRobotic process automation for repetitive, rules-based manual tasksDocument processing automation extraction, structuring, routingCRM, ERP and finance-system integration and automationEmail and communication automationAutomated reporting, delivered on a scheduleAI-assisted automation document review, classification, anomaly flaggingAutomation builds on platforms such as Zapier, Make or n8n, where that is the right fitMiddleware and API integration between systems that do not natively connectAutomation audit mapping which manual processes are worth automating

06 / 06

System builds & technology adaptation

Brought forward without stopping the business.

Legacy modernisation / Cloud migration / Infrastructure-as-code / System integration / Zero-downtime transition

Infrastructure stood up properly, and legacy technology brought forward for organisations that already work. The risk is not the migration, it is the downtime.

What it covers

Legacy system modernisation and technical-debt remediationOn-premise to cloud infrastructure migrationMigration sequencing where downtime is not an available optionTechnology stack audit and recommendationIntegration between platforms that were never built to talk to each otherInfrastructure-as-code setup for repeatable, auditable environmentsScalability and performance re-architectureVendor and tooling evaluation ahead of a purchase decisionData migration with integrity verificationChange-management support for teams adopting the new system

Whichever one you pick, it runs the same way.

SurveyWe read what exists (systems, workflow, obligations) before proposing anything. No recommendation is made from a template. Output: Findings memo.
SightlineA written specification and a plan you can weigh, price and challenge. No black boxes and no lock-in. Output: Specification & plan.
BuildDelivery in visible increments, with security decided in the same conversation as the feature rather than bolted on at the end. Output: Working increments.
AssureTesting, audit evidence and handover documentation, so the result is defensible to a board, a client or a regulator. Output: Evidence & handover.

Start with the problem, not the product.

Tell us what the system has to do. We will tell you what it takes to build it, secure it, or prove it works.