The homepage sells the outcome. This page is for the person who wants to know what actually runs underneath it — twelve layers, each documented, monitored and owned by you.
Microsoft Entra ID · Google Workspace identity
Every user, device and application authenticates through one identity provider, with MFA and Conditional Access enforced, privileged access controlled and sign-ins monitored. Identity is where most breaches start, so it's where the baseline starts.
Where this lives in the platformMicrosoft 365 · Google Workspace
Email, files, chat and collaboration in your own tenant, configured to a documented baseline: sharing defaults, external access, retention, legacy protocols off. Backed up separately, because the platform doesn't do that for you.
Where this lives in the platformRemote monitoring and management · Managed endpoint detection and response
Every laptop and desktop enrolled in device management, encrypted, patched on a schedule, protected by managed EDR, and checked by automated health and security monitoring around the clock, with problems raised as tickets that an engineer picks up within support hours.
Where this lives in the platformWeb application firewall · DNS filtering · Email security · Vulnerability scanning · Password vault
Layered controls across identity, endpoint, email, DNS and web, run as a Prevent → Detect → Respond → Recover loop. Logged centrally so we can answer 'what happened?' with evidence.
Where this lives in the platformMicrosoft Azure · AWS · UpCloud · Civo
Enterprise cloud where the workload needs it; cost-effective UK and European infrastructure for everything else. Least-privilege access, private networking, infrastructure defined in code where it earns its keep.
Where this lives in the platformImmutable backup platform · Microsoft 365 / Google Workspace backup
3-2-1 architecture with immutable, isolated copies. Every protected system has defined recovery targets, a scheduled test restore, and a record of the result — Foundry Recovery Assurance.
Where this lives in the platformCloud VoIP platform · Microsoft Teams telephony
Business numbers in the cloud, ported and registered to you, with routing, queues, recording and mobile failover. Teams-native calling where the team already lives in Teams.
Where this lives in the platformRegistrar account in your name · Managed DNS · CDN and WAF · Managed hosting
Domains, DNS, certificates, edge delivery and hosting run as one chain, with every record documented and every certificate renewed automatically.
Where this lives in the platformTypeScript and .NET services · managed databases · APIs · infrastructure as code
The software Foundry builds runs on the infrastructure above, on your identity, with monitoring, backups and documentation from day one. Source is held in repositories you own; environments are defined in code so they can be reviewed and rebuilt.
Where this lives in the platformWorkflow orchestration · system connectors · approval and audit stores
Workflows across your systems run on an orchestration layer with an owner, a trigger, an idempotent action, a record of every run and a failure path to a person. The same runtime carries Foundry's own delivery automation.
Where this lives in the platformModel abstraction · private retrieval (RAG) · Azure-sold models · Claude on Bedrock · enterprise APIs · self-hosted models
One interface over several model providers, chosen per workflow by data classification. Retrieval, vector storage, prompts, approvals and audit logs stay in your environment; the model is a swappable component, not the system.
Where this lives in the platformInfrastructure, endpoint, backup, certificate and uptime monitoring
One place where everything we run reports in. Alerts become tickets automatically, and the monthly report you receive is generated from the same data we use to run your environment.
Where this lives in the platformWe name the platforms you’d own an account with — Microsoft, Google, the cloud providers — because those are yours. We describe the operational tooling we use to run environments by category rather than brand, partly because we choose tools on merit and replace them when something better exists, and partly because publishing a full stack diagram of every customer’s security tooling is not a favour to anyone. Ask on the call and we’ll tell you.
How we protect customer environmentsRemote-first / UK-wide / one team
Thirty minutes with an engineer, not a salesperson: what you run today, what’s at risk, what should be automated, and what we’d build or wouldn’t.
30 min call / no pitch / no obligation