Managed Services
Security for your Drupal platform
Make security and accountability concrete for your Drupal platform: from access and code to hosting, edge protection, audits and incident response.
Security & compliance
Security has several layers, each with clear responsibilities
Before the application
Edge Shield filters traffic, caches content and follows up on blocked requests before they reach your Drupal site. Edge protection adds a first layer; it does not replace code maintenance.
Platform and environments
Updates, monitoring, access and recovery arrangements for your environments. Operations cover the agreed components and service levels.
Code and dependencies
We agree which checks are performed, who reviews findings and who handles remediation. Finding an issue is only half the work; fixing it is the other half.
Security audit
Security audit: from risk to remediation
Within an agreed scope, we examine access, configuration, dependencies, data flows and operating practices. We start from your architecture, digital strategy and business objectives, and look at Drupal core, modules, related applications and integrations, including design choices that could cause problems later. AI applications can be included too: source permissions, prompt injection, information leakage and tool authority.
Before the audit begins, we agree which systems, accounts and environments may be examined and how findings are shared. GDPR, NIS2 or preparation for ISO 27001 can be relevant frameworks; legal conclusions and certification need their own qualified assessment. You receive:
• A prioritised risk assessment, with impact, evidence and an owner for every finding
• Visible gaps against the agreed requirements
• A remediation plan that separates urgent fixes from structural improvements
• A retest to confirm that remediated issues are resolved
No audit can guarantee that every possible vulnerability is found, but it gives you a solid basis for decisions and follow-up.
Edge Shield
Edge Shield: protection before traffic reaches Drupal
Edge Shield is a managed layer in front of your Dropsolid-hosted platform. It handles traffic before it reaches your Drupal environment, combining four tools in one operating model:
• Always-on DDoS protection against volumetric and application-layer attacks
• A managed web application firewall, with rules tuned to your application and exceptions and changes managed by us
• A global CDN that caches content close to your visitors, using Drupal cache tags
• Bot management that separates useful bots from scraping, credential stuffing and account abuse
Caching, certificates, redirects, support and pricing are confirmed for your application. Global edge processing comes with its own data-processing and residency documentation.
Compliance & quality management
Compliance you can demonstrate
Compliance does not automatically follow from a platform or a certificate. You need to show how identity, code, infrastructure, data and incidents are managed. We translate your requirements into responsibilities, checks, evidence and release conditions, so documentation stays connected to delivery:
• Strong authentication, least privilege, secrets management and network boundaries
• Updates and dependencies managed with version control, vulnerability scanning and an evidenced software supply chain
• Logs, monitoring, backups, recovery tests and incident response, each with a named owner
Dropsolid NV is certified to ISO/IEC 27001:2022. In procurement and contracts, refer to the current certificate, scope and validity. Hosting on the platform does not automatically make you compliant with GDPR, NIS2 or the AI Act: processing and accountability need their own assessment, and legal interpretation stays with qualified specialists.
Trust, governance & continuity
Know where your data is and what you can fall back on
A hosting location does not answer every question about access, AI processing or handover. We start from your data flows and the parties involved, and make visible:
• Who has access: roles per organisation, and who removes access when responsibilities change
• Where your data is: data, backups, supporting services and the suppliers that may have access
• How AI is used: permissions, model choice and the ability to inspect AI processing
• How you continue: how data and configuration can be transferred, and who performs the handover
Continuity needs agreements and exercises: how changes are released, who handles incidents and how recovery is tested. A good first step is to walk through one critical release and one incident together, and to note for every step who approves, which log provides the evidence and how recovery works.
