Build and care
One provider for the build, and for the years after it.
Most firms hand you a launch. Palisadium hands you a launch and then keeps working. The build, the hardening and the ongoing care sit in the same relationship, with the same point of accountability.
Design and prototype
We work from your actual content, not a template. The prototype is reviewed before any code is written, so the direction is confirmed before the build starts.
Deliverables: design direction, wireframes, prototype review session.
Development and hardening
Built in one maintainable codebase. Security controls are written while the code is written, not bolted on after. Every item on the baseline is checked, or marked not applicable with a reason.
Deliverables: development, content integration, security baseline applied, testing against acceptance criteria.
Launch and handover
You receive a written handover: what was built, what was checked, what remains your responsibility. A signed copy of the security baseline is retained as the audit trail behind the word “secure.”
Deliverables: launch, handover documentation, signed baseline copy.
Care — monthly
Dependency updates, uptime monitoring, backups with a tested restore. Each cycle is recorded and reported. The work that keeps a product credible after launch.
Cadence: monthly, with a quarterly review of coverage, costs and what changed.
Care — incident response
When something goes wrong, you have a named contact and a written path to follow. We respond, contain, and document. What remains your responsibility is stated up front.
Coverage: written incident response contact, defined scope of response.
Defend — periodic testing
For products with real stakes: application testing, periodic penetration testing with your explicit authorisation, remediation carried through to a finished state.
Offered to qualified projects, within agreed scope, separately authorised.
What we do not do
- Penetration testing without your explicit written authorisation
- Work on systems we don’t own and don’t have documented access to
- Compliance certifications or attestations — we can prepare evidence, not issue them
- Managed hosting on a platform we don’t maintain — we build, you choose where it runs