After launch, we keep it running.
The people who built your product keep running it. Every duty has a named owner, backups are tested by restoring them, and you get a report each month.
Care plan11.5 of 16 h
September 202699.98%
August 2026100%
July 202699.99%
June 2026100%
All systems operationalSeptember report
A quiet month. Two short incidents, both fixed inside the hour.
Available
99.98%
Target 99.90%
Incidents
2
Resolved in 9 and 34 min
Backups restored
30/30
Each night, on a test server
1 SepEvery day of the month30 Sep
LiveRelease 2.15, 16 Sep
- Website100%
- Client portal99.98%
- API100%
- Mail100%
Availability
Every hour of September. Brighter hours were busier and slower.
Latest incident
ResolvedAPI responses slow
Thu 17 Sep
34min
- Started10:41
- Detected10:44+3 min
- Responded10:49+8 min
- Resolved11:15+34 min
Ana Berescu, on callAddress lookups now fall back to cached results after 800 ms.
All incidents
Selected incident
ResolvedClient portal down
Wed 9 Sep
9min
- Started14:02
- Detected14:03+1 min
- Responded14:05+3 min
- Resolved14:11+9 min
Stelios Manaras, on callThe portal database moved to its standby copy. The failed disk was replaced that evening.
All incidents
Security updates
14 applied in September. Every security fix went live inside 48 hours.
48 h promise
server-runtime3.9.4 → 3.9.7
High19 hhttp-router3.1.4 → 3.1.6
Moderate31 hsession-store2.8.0 → 2.8.3
Moderate44 hweb-framework6.3.2 → 6.4.0
RoutineApplied 3 Sepimage-resize0.33.1 → 0.34.0
PerformanceApplied 16 Sep
Certificates
Days until each one expires
TLS certificate61days
Expires 1 Dec
Mail signing key94days
Expires 3 Jan
Domain name224days
Expires 13 May
Auto renewal is on for all three
Who does what
Named owners, agreed in July
- Monitoring and incidents
![]()
Ana BerescuEWC - Security updates
![]()
Ana BerescuEWC - Staff accounts and leavers
![]()
Petra LindqvistHalvorsen - Second factor for admins
![]()
Sigrid HalvorsenDue 9 Oct
HSeptember 2026 report
99.98%
Reviewed1 Oct 2026September 2026 report
Ana Berescu and Stelios Manaras, 1 Oct
Review call Thu 8 Oct, 10:00
Saved to Downloadshalvorsen-care-2026-09.pdf
Halvorsen & CoA monthly care report: uptime, patches, backups, incidents. Fictional business, built to show the work.
Report v2
Penetration testTested 7 to 18 September 2026
Customer portal test
portal.grenholm.example /api/v2
Maja Lindahl and Nils MobergSkerry Point, lead and second tester
Open risk
15 findings- 9.1GRN-01Password reset links never expireClosed
- 7.1GRN-04Shipment documents readable by other customersRetest passed
- 7.6GRN-02Script stored in shipment notesFixed, retest 2 OctRetest passed
- 7.3GRN-05No lockout on the staff loginOpen, fix due 7 Oct
- 5.4GRN-07Session survives logoutOpen
- 4.3GRN-09CSV export shows internal user IDsRisk accepted
9 more
GRN-04Retest passedClosed 28 Sep
Any signed-in customer can download another customer's shipment documents
Affected endpoint
GET/api/v2/shipments/{id}/documentsGRN-02Fixed, retest bookedRetest passedClosed 30 Sep
A script saved in shipment notes runs when staff open them
Affected endpoint
POST/api/v2/shipments/{id}/notesView fixroutes/notes.ts+1 -1
const note = await notes.create({
- body: req.body.text,
+ body: escapeHtml(req.body.text),
shipmentId: req.params.id,
});
Göran Ek, 29 Sep. Released in portal 4.13.
How we reproduced it
- 1Sign in as test customer Brask Kaffe
- 2Change our shipment number to a neighbour's
- 3The portal returns their customs invoice
RequestBrask Kaffe
GET /api/v2/shipments/88213/documents HTTP/1.1Host: portal.grenholm.exampleCookie: session=7f3a…c91eAccept: application/jsonReferer: /shipments/88207Ours is 88207
Response142 ms
HTTP/1.1 200 OKContent-Type: application/json{ "shipment": 88213, "customer": "Ostra Hamn Trading", "file": "customs-invoice-55120.pdf", "declared_value": "41 870 EUR"}Another customer
Nothing checks who owns shipment 88213
How we reproduced it
- 1Sign in as test customer Brask Kaffe
- 2Save a note that contains a script
- 3A staff member opens the shipment
RequestBrask Kaffe
POST /api/v2/shipments/88207/notes HTTP/1.1Host: portal.grenholm.exampleCookie: session=7f3a…c91eContent-Type: application/json{"text": "<script>alert(1)</script>"}Saved as typed
Staff page96 ms
HTTP/1.1 200 OKContent-Type: text/html<li> <script>alert(1)</script></li>Runs for staff
Note text reaches the staff page without escaping
The fix
routes/shipments.ts
const doc = await documents.findOne({
id: req.params.id,
+ customerId: session.customerId,
});
+if (!doc) return forbidden(res);
Göran EkGrenholm Freight, 26 Sep
Every document lookup now filters by the signed-in customer. Released in portal 4.12.
The fix
server/headers.ts
app.use((req, res, next) => {
+ res.setHeader("Content-Security-Policy",
+ "script-src 'self'");
next();
});
Göran EkGrenholm Freight, 29 Sep
Notes are escaped when saved and inline scripts are blocked. Released in portal 4.13.
Retest
Same request after the fix
GET/shipments/88213/documents
403 Forbidden
Our own shipment still loads
GET/shipments/88207/documents
200 OK
Maja Lindahl, 28 Sep
PassedRetest
The same note, opened by staff
GET/staff/shipments/88207
Shown as text
New notes still save
POST/shipments/88207/notes
201 Created
Maja Lindahl, 30 Sep
PassedPath to zero highs
Critical and high findings still open, day by day
- 7.6GRN-02Script in shipment notesFri 2 OctRetest booked
- 7.3GRN-05Staff login lockoutWed 7 OctFix in review
- Requests
- Records of processing
- Breaches
- Suppliers
Open requests5
Every request from a customer about their data, with the legal clock beside it.
5open now
9 daysto the closest deadline
19 daysaverage reply this year
Deadlines
Femke MaartensAccessSent 24 Sep
Fleur van DamAccessExtended to 5 Dec
Bartek WronaErasure9 days left
Yasmin SalehPortability16 days left
Pieter ClaesCorrection24 days left
DSR-0147Access request, Article 15
Femke Maartens
Customer since March 2021
Where her data lives
Seven systems searched, six hold data about her
Femke MaartensCustomer account
Profile and 3 addresses
ExportedOrders
214 orders since 2021
ExportedDelivery app
188 drop offs, 41 photos
Courier names removedSupport desk
12 tickets, 2 calls
10 redactionsSearched 14 Sep
12 tickets, 2021 to 2025
2 call recordings, transcribed
Other people's details hidden
support.pdf
Newsletter
Consent and 2 changes
ExportedCard payments
Dates and last 4 digits
ExportedWeb analytics
Not linked to a person
Nothing to exportReceived
Wed 2 Sep, by emailIdentity
Checked 4 Sep against two recent ordersLegal deadline
Fri 2 OctSuppliers asked
Delivery app vendor, replied 11 SepFee
NoneHandled by
Sanne de WitWhat we sent
profile.json1 profile, 3 addressesorders.csv214 rowsdeliveries.csv188 rows, 41 photossupport.pdf12 tickets, 10 redactionsconsent-log.csv3 entries
What we held back
Ticket 5881214 June 2025
My box was left at number 1222Could identify her neighbour again. Your driver Marco1 said he was running late. My neighbour Marloes Visser2 brought it over, but the frozen bag had thawed.
Sorry, Femke. We have refunded the frozen items, €6.40, to your card.
- 1A staff member's name
- 2Another person's details
10 redactions, each with its reason
Reply sent in time
Fernhill
Dear Ms Maartens,
Here is a copy of the personal data Fernhill holds about you, where it comes from, why we use it and how long we keep it.
Secure download, open until 24 Oct
Opened 25 Sep
Monitoring
Bank transactions from two banks are arriving late
Invoicing, payments and everything else are working normally.
- Investigating
- Identified
- Fixing
- Monitoring
- Resolved
5 of 6 services working normallyChecked 1 minute ago
- Eikeland BankDelayed
- Crescent BankDelayed
- 41 other banksWorking
Bank feedsStarted 06:30Wednesday 30 September
Late bank transactions for Eikeland Bank and Crescent Bank
11:20
Monitoring
Transactions are arriving again. This morning's backlog should be cleared by 13:00. You don't need to do anything, and nothing will be imported twice.
10:05
Fixing
Our bank data provider has restarted the connection to both banks. We are watching the first transactions come through.
08:41
Identified
The delay is at our bank data provider. Transactions already in Tallybook are safe; new ones will appear once the connection is back.
07:52
Investigating
Some customers are seeing no new bank transactions since about 06:30. We are looking into it.
Ines DuarteSupport lead, last update 11:20
Services
Uptime over the last 90 days
Web app99.98 %Working
Invoice sending99.95 %Working
Bank feeds99.71 %Delayed
- Eikeland BankDelayed
- Crescent BankDelayed
- 41 other banksWorking
Card payments100.00 %Working
Public API99.99 %Working
Mobile apps99.97 %Working
90 days agoToday
Planned maintenance
Database upgrade
Sunday 4 October, 02:00 to 02:40 CEST
Invoices can't be sent for up to 10 minutes during this window. Scheduled invoices go out as soon as it ends.
Tomas LindPlatform team, runs the upgrade
Past incidents
- 29 SepNo incidents
- 28 SepInvoice PDFs slow to generateResolved in 22 min
- 23 SepSome mobile app users were signed outResolved in 1 h 5 min
Incident history
Get updates
We'll tell you when an incident starts, changes or ends, and two days before planned work.
Only for bank feeds and invoice sending
One click to unsubscribe from any message.
What to look at
What this covers
Every service in this family.
Operate, support and improve websites, applications and the infrastructure under them. 18 services
- Managed website hostingDeployment, configuration and agreed resource limits.
- Managed application and API hostingOperate services, workers and application environments.
- Database and storage operationsManaged data stores, storage configuration and maintenance.
- Hosting and cloud migrationMove agreed workloads with a tested transition plan.
- Domain, DNS, TLS and CDN setupConfigure routing, certificates and content delivery.
- Business email integrationConnect your chosen mail provider and set up the DNS records it needs.
- Backups and recovery exercisesBackup retention, restore checks and documented recovery.
- Website and application maintenanceDependency updates, fixes and agreed support coverage.
- Content and product updatesMaintain agreed pages, assets, listings and product information.
- Availability and error monitoringAlerts, logs, service checks and incident investigation.
- Performance and capacity workMeasure bottlenecks and improve supported workloads.
- Security review and hardeningReview application, identity, hosting and delivery controls.
- Authorized security testingTesting within a defined scope, and checks that the fixes hold.
- Incident recovery and remediationInvestigate failures and restore the agreed service.
- Privacy and access engineeringData minimization, access controls and retention built into the system.
- CI/CD and release engineeringBuild pipelines, deployments, rollback and environment configuration.
- Infrastructure and cost optimizationReview hosting topology, resources and operating costs.
- Ongoing technical supportDefined response coverage, reporting and escalation.
Technology options
Linux servers, containers where they help, web servers and reverse proxies, DNS and content delivery, automated releases, infrastructure as code and monitoring. Managed hosting is a service we are responsible for: an infrastructure provider alone does not maintain your code.
How we choose technologyQuestions
Do I need to do anything technical?
No. Hosting, maintenance and support stay with us, and your content stays yours.
Can you take over a system someone else built?
Often, yes, after a review. We tell you plainly what would need fixing first.
What happens if something breaks?
Our incident plan names who acts and how you are kept informed. Afterwards we write up what happened and what changed.
What does the monthly report include?
Uptime, updates applied, backup and restore checks, security events and anything that needs your decision.
Start
Tell us what you are building.
A short description is enough. You get a straight read on scope, cost, and our honest take on the best approach, before anyone commits.
Write to [email protected] · New projects and general questions
- Built from zero, no templates
- Hosted and maintained by the same team
- Scope and cost agreed before we start
- Updates, monitoring and support after launch
- Findable in search and AI answers
