Skip to content
Sondeon

For the CTO and the head of infrastructure

Server hardening and security audit of the deployment server Your system is going to production. Who else can get into the server?

We review the deployment server (the machine your system will run on) before you go live. You get what it has open, what it is missing and which limits break as you grow.

You get the technical report and the action plan to approve point by point. Scope and timeline are in writing before we start.

Dark blue printed circuit board without components, with gold tracks and contacts

Updated on

Who it is for

  • You are deploying a system built with AI to production
  • Nobody has looked at the server since it was set up
  • You don't know whether backups exist and have been tested

You don't need it if you deploy on a managed platform where you don't administer any server. We also don't size or sell hardware.

The server is the door to your business

Correct code on an open server is still exposed. A full disk or an expired certificate stops the service without a single flaw in the code. According to CIO Dive, reporting on an S&P Global Market Intelligence survey (2025), organizations scrapped on average 46% of their AI proofs of concept before they reached production.

46%

AI proofs of concept scrapped before production

S&P Global Market Intelligence, 2025

What the security audit of your server covers

  • Access, sessions and permissions
  • Secrets and sensitive files
  • Network and open ports
  • Containers, patches and running services
  • Hardening: reducing what the system exposes
  • Storage and backups
  • Certificates, web server and break-in attempts in the logs

More than 150 control points

Technologies covered

  • Linux
  • nginx
  • Docker

Trademarks and logos belong to their respective owners. Their use here is descriptive only and implies no commercial relationship or sponsorship.

How it works

  1. Meeting and written scope

    In 30 minutes we look at what server you have and what will run on it. Then you get in writing what is reviewed, what is left out and the timeline.

  2. Review over SSH, with no changes

    We connect over SSH or run it with your team on the machine itself. The review changes nothing on the server.

  3. Report and action plan

    You get the technical report, the report for leadership and an action plan. You approve the changes point by point.

What we need from you

  • SSH access to the server, which we only use to read
  • Or running it with your team on the machine itself
  • Someone who knows how the system is deployed

How we work

What you get

  1. Technical report, with the evidence for each finding
  2. Report for leadership, ranked by impact
  3. Action plan, to approve point by point
  4. Before and after: what has changed since the previous review

How a finding arrives

Priority: High

Database open to the internet

Where
Production server, PostgreSQL port
Evidence
It accepts connections from outside the company network
Impact
Anyone can try to get into your data

An example of the report format, not a client's.

Shall we talk about your case?

A 30-minute meeting to see what you have and what to review first.

Book a free meeting

Expert review, automated tool or the AI itself

All three are useful, each for one thing. AI brings the volume and people bring the judgment: that is why our review uses an automated AI tool and senior developers supervise it.

See the full comparison

Hands drawing a diagram of screens joined by arrows with a marker on a small whiteboard, next to white headphones

Who reviews

The review is done by a team of senior developers, with many hours of development and of finding the mistakes AI makes when it codes. We know more than 1,200 review points. The automated AI tool goes through them, and people verify, direct and review.

Team of senior developers

José María Salido, founder of Sondeon, answers for it

  • AI brings the volume: it goes through the known review points
  • People bring the judgment: they verify every finding before it goes into the report
  • The result is explained in a meeting with your team
Who answers for it: José María Salido, on LinkedIn

Frequently asked questions

What is server hardening?

It is reducing what a server exposes: closing ports and services that are not needed, limiting who gets in and with what permissions, and keeping the system up to date. We review what state yours is in and tell you what is missing, by priority.

How much does a server security audit cost, and how long does it take?

The 30-minute meeting is free. The rest depends on how many servers are included and on what runs on them. We go over it in that meeting, and you get the scope and timeline of our health check in writing before we start.

Do you size the server I need?

We review the server you already have or the one you are going to use and tell you which limits break as you grow. We don't sell or size hardware.

What do you need, and do you have to get into production?

We need SSH access to the server, or to run it with your team on the machine itself. The review only reads: it changes nothing on the running server.

Who applies the changes on the server?

The diagnosis comes first. The changes go into an action plan that you approve point by point, and the fix is separate: your team applies it, or we do only if you ask.

What is a server security audit, and which servers do you review?

It is a review of who can get into a server and what it exposes: access, open ports, secrets, containers, patches and backups. Our health check covers Linux and macOS servers, in the cloud or in your data center, over SSH or on the machine itself.

Other services

  • Mobile app review

    Flutter apps built with AI, tested on real iOS and Android phones by command and with touch gestures, together with their backend.

  • Public website review

    Your website's performance, visibility in search engines and in AI assistants (SEO and GEO), accessibility and security, measured on the real page.

  • Backend and API review

    The server side behind your app or your website: what the API exposes, what it protects, what headers it serves and what ends up in its logs.

  • Database review

    PostgreSQL, Redis, Elasticsearch and RabbitMQ, in read-only mode: structure, indexes, slow queries, locks and connections.

  • Infrastructure monitoring

    The Linux machines your system runs on, measured every few seconds, so you see a full disk or a stopped container before your users do.

  • API monitoring

    Every call to your API measured, with its latency, its error and the screen that requested it, so you know which endpoint to optimize before traffic grows.

All services

Request your free meeting

Fill in the form and we email you to set a day and a time. It is 30 minutes to see what you have and what to review first.

What should we control?

We use your details to answer your request, to be able to prove we received it and to protect the form. The privacy policy explains it in detail.