IT services and DevOps
Cloud and hosting setup, Cloudflare, Linux servers, CI/CD, backups, email authentication, and ongoing support.
IT services · Web security · Software
Infrastructure, security, and software for small teams, built to hold.
We are a small, senior, remote studio. We set up and run the systems behind your business, find and fix security gaps, and build fast, secure web software for small businesses, solo founders, and startups.
$ curl -sI https://redcastlestudio.com/
HTTP/2 200
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-security-policy: default-src 'self'; script-src 'self' 'sha384-…'; frame-ancestors 'none'; …
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cross-origin-opener-policy: same-origin
permissions-policy: camera=(), microphone=(), geolocation=(), …What we do
Three services, one standard
Whether we are configuring DNS, testing a login form, or shipping an MVP, the work is documented, secure by default, and yours to keep.
Web and application security
Security audits, header and TLS hardening, OWASP Top 10 testing, WAF and bot protection, and reports written for owners.
Software development
Websites, web apps, SaaS MVPs, job boards and marketplaces, APIs, and internal tools, built fast and built to last.
Products we build and run
We run our own products, so we know what production takes
We own and operate two niche job boards. We build them, host them, secure them, and grow them, so the advice we give clients is advice we follow ourselves.
A job board for civil engineering roles.
We can build, host, secure, and grow a niche product on our own budget, which is the same work we do for clients.
A job board for defensive cybersecurity (blue team) roles.
A security audience expects a product that is secure by default. Running one keeps our own security practice honest.
How we work
A clear process, with no surprises
Every engagement follows the same four steps, whether it lasts a week or runs as ongoing support.
Discover
A short call and a read-only look at what you have today. We ask what success looks like and what is off limits.
Plan
A written plan with scope, price, timeline, and risks. You know what you are paying for before work starts.
Build and secure
We work in small, reversible steps, with security built in rather than added at the end. You see progress as it happens.
Support
Ongoing maintenance and monitoring if you want it, or a clean handover with documentation if you do not.
Security by default
We hold our own site to the standard we sell
These are not promises in a brochure. You can check them yourself by inspecting this page's response headers.
Strict Content Security Policy
This site allows no inline scripts except ones we have hashed, and blocks framing by other sites.
Secure headers by default
HSTS, nosniff, a strict referrer policy, cross-origin isolation, and a locked-down permissions policy.
No trackers, no cookies
We use privacy-friendly Cloudflare Web Analytics only, so there is no cookie banner because there are no cookies.
Least privilege
Client access is scoped to the job and removed when it ends. Secrets live in a secrets store, never in code or email.
Have something that needs to be built, fixed, or locked down?
Tell us what you are working on. You will hear back from the person who would actually do the work.