Introduction
Security can’t be an afterthought—especially for platforms that handle sensitive corporate data across global markets. One of our clients, a fast-growing software provider in the legal technology sector, came to us with a critical need: to bring their infrastructure up to the standards required by both internal stakeholders and external auditors, without slowing down their product roadmap.
Their team had built something innovative, but like many scaling companies, they were moving quickly—and their security posture hadn’t kept up with the pace. They needed a partner to help assess the risks, rebuild the foundation, and guide them toward sustainable compliance. That’s where we stepped in.
WANT TO GET YOUR COPY?
Access the PDF for key insights!
The Client and Their Challenge
Working time:
2023-2024
Industry:
Legal Tech
The service:
Security Compliance
Overview
This North American SaaS company offers a platform designed to help large enterprises manage complex legal structures, automate compliance filings, and centralize governance across jurisdictions. Their customers operate in regulated industries and expect strong security practices by default.
By the time we were brought in, the company’s technical debt was beginning to impact reliability and compliance. Key issues included:
- Publicly exposed cloud resources that didn’t align with compliance requirements
- A network lacking high availability or proper segmentation
- Cloud storage misconfigurations, with data accessible from public endpoints and no secure file transfer mechanisms in place
- A self-managed database that was outdated, lacked backups, and wasn’t properly secured
The goal wasn’t just to patch things up. The task was to deliver a security-first platform that would stand up to audits, scale with the business, and support a fast-moving engineering team without adding friction.
Our Approach
We treated this as a full security rebuild—with compliance built in from the start.
Step 1: Network Re-Architecture
We began by designing a new AWS network environment focused on isolation and control:
- All public-facing services were removed or routed internally using VPC endpoints
- Intrusion detection and prevention systems (IDS/IPS) were implemented to monitor traffic patterns and identify potential threats early
- VPN access was rebuilt around role-based controls, ensuring only the right individuals had access based on their responsibilities
Step 2: Locking Down Storage and File Transfers
Cloud storage was reconfigured to enforce privacy and encryption:
- All buckets were set to private access only, with strict IAM policies and encryption enforced at rest and in transit
- We introduced a custom SFTP solution restricted by IP allowlists and backed by dedicated IAM roles, giving the client full control over who could move data and how
Step 3: Database Hardening
The self-managed database was replaced with MongoDB Atlas, giving the client:
- Built-in high availability and backups
- Automated patching and maintenance
A secure VPC peering connection that ensured data never traveled across the public internet
Security That Scales
One of the most valuable outcomes was the implementation of a layered security model, designed to reduce reliance on any single control. This included:
- AWS WAF, filtering malicious traffic before it reached the application
- AWS Network Firewall, enforcing fine-grained rules inside the VPC
- AWS GuardDuty, providing continuous threat detection and monitoring
- VPN access with strict RBAC policies, defining clear access boundaries across teams and environments
Together, these controls created a secure-by-default platform with visibility, accountability, and enforcement built into every layer.
Results
With these changes in place, the client’s platform is now compliant, resilient, and ready for continued growth—with confidence.
- All public resources were secured or eliminated
- A multi-layered security architecture is now actively protecting the environment
- Storage is encrypted and tightly access-controlled, with secure file transfer protocols in place
- The database is now fully managed, backed up, and highly available
- VPN access is governed by role and environment, providing security without operational slowdowns
Everything is structured, documented, and auditable. Most importantly, the engineering team didn’t need to become compliance experts—we took that off their plate, so they could stay focused on product and delivery.
If you find this case interesting, we recommend taking a closer look at
Let’s Build Yours
If your platform is growing and you’re feeling the pressure to get security and compliance under control—we can help. Whether you need a complete rebuild or a clear path to audit-readiness, we’ll meet you where you are and help you move forward with confidence.
Let’s build a cloud environment that your team can rely on, your customers can trust, and your business can scale with.
