AI & Data · Govern
Protect the systems your business runs on.
Consultancy, measures and monitoring that protect your storefront, customer portals, integrations and AI from attack and abuse: the systems we build for you, and the ones we didn't. Run under our ISO 27001 certified information security controls.
Three ways we help.
Security runs through everything we do, from the first review to the system running in production.
Security consultancy
An independent review of your storefront, portals, integrations, hosting and AI against the standards that apply to you, with the risks ranked by impact and a plan to fix them. On its own, or before a new build or migration.
Secure by design
Every system we build is designed, coded and tested to our ISO 27001 secure development policy, with access kept to the minimum, secrets kept out of code, dependencies kept up to date and every change reviewed.
Protected and monitored
The tools and monitoring that keep it safe once it's live, watched around the clock, patched on a schedule and backed by a tested incident process, for the systems we wrote and your other systems too.
The attacks that hit commerce and portals.
B2B storefronts and customer portals hold card payments, trade accounts, contract prices and customer data. These are the ways they get attacked.
Card skimming at checkout
Malicious scripts slipped into a payment page to copy card details. We keep an inventory of every script on your payment pages and watch for changes, as PCI DSS v4.0.1 now requires.
Account takeover
Stolen passwords tried at scale against trade and customer accounts. Multi-factor sign-in, rate limits, alerts on unusual logins and, for trade portals, sign-in restricted to the networks you expect.
Bots and card testing
Automated traffic testing stolen cards, scraping your prices or hoarding stock. Bot protection and limits at the edge, before it reaches your platform or your payment provider.
Vulnerable code and extensions
Out-of-date platforms, modules and plugins are the usual way in. Security patches applied on a schedule, extensions reviewed, and code audits like our Magento health checks.
Integrations and suppliers
Every connection to your ERP, CRM, payment and delivery systems is a door. Keys and permissions kept to what each one needs, stored securely, and reviewed when people or suppliers change.
AI misuse
Assistants and agents can be steered by what they read. We test against the OWASP Top 10 for LLM applications, including prompt injection, and keep anything that acts on your systems behind controls in code.
Protection that keeps working after launch.
Security isn't a one-off. These run for as long as we look after your systems.
Web application firewall and bot protection
Malicious requests, bots and floods of traffic filtered at the edge, with rules tuned to your site.
Payment page script monitoring
An inventory of every script on your checkout, with an alert when anything changes.
Vulnerability and malware scanning
Your platform, code and extensions scanned on a schedule, with the findings fixed in order of risk.
Patching and updates
Platform, server and extension security patches applied and tested on a schedule, not left to pile up.
24/7 monitoring and incident response
Your sites and hosting watched around the clock, with a tested incident process under our ISO 27001 controls if something does happen.
Backups and recovery
Backups taken, kept apart and restored in tests, so you know you can recover.
Not just what we built.
Attackers don't care who wrote the code. We can review and protect systems built by others, and the platforms you run on.
Systems built by others
Storefronts, portals and apps from another agency or your own team reviewed, then fixed and looked after, as we do when we take over and recover Magento projects.
Hosted platforms
Shopify Plus and BigCommerce look after their own platforms, but your apps, scripts, staff accounts and integrations are still yours to secure. We cover your side.
Back office and integrations
The connections between your storefront and your ERP, CRM and suppliers, where data moves and keys are kept.
Free tool
Do you know every script on your checkout?
List every script on the way to your checkout and who it belongs to, checked against PCI DSS 6.4.3 and 11.6.1. Free, in seconds.
Measured against recognised standards.
ISO 27001
Our own information security management system, independently certified and audited every year.
OWASP
The OWASP Top 10 for web applications, and the OWASP Top 10 for LLM applications for anything with AI in it.
PCI DSS v4.0.1
The card industry's rules for anyone taking payments, including the payment-page script rules in force since March 2025.
Cyber Essentials
The UK government-backed scheme for the basic controls every business needs. Our ISO 27001:2022 certification goes further, and we help you get ready for Cyber Essentials.
Software Security Code of Practice
The UK government's 2025 code for organisations that build software, from secure development to telling customers about incidents.
Plan. Build. Govern.
Plan
Where AI pays, and in what order. For a whole business, the PureNet Group's Converge Methodology; for a single area, a fixed-scope assessment.
Build
A pilot with a number to move, an owner and a way to stop it, then production in your storefront, portal and back office, integrated with your ERP and CRM.
Govern
Govern the use, not the technology. Your own AI on business terms, with an owner, a one-page policy and an inventory; and every system we build for you tested on every change, logged, overseen by a person and fitted with an off switch, under our ISO 27001 controls.
What people ask us.
Do you do penetration testing?
Yes. We arrange independent penetration testing, so the people testing your systems aren't the people who built them, then fix what it finds and test again. Our own testing is checked as part of our ISO 27001 audits.
Can you look after systems you didn't build?
Yes. We start with a review of the system, its hosting and its integrations, fix what matters most first, then protect and monitor it like our own.
Isn't Shopify or BigCommerce already secure?
The platform is, and its provider looks after it. Your apps, scripts, theme code, staff accounts and integrations are still yours to secure, and that's where most problems start.
What happens if there's an incident?
We follow our ISO 27001 incident process. We contain it, tell you straight away, find the cause, fix it and record what we've learned. If you take card payments, we also help you meet your obligations to your payment provider.
Do we need this if we already have IT support?
Usually, yes. IT support looks after your offices, laptops and email. We look after the systems your customers use: your storefront, portals, apps and the integrations behind them. We're happy to work alongside your IT team.