Anyone can say they take security seriously. We can show it. Standards-based IT and cyber security is not a slogan for us. It is how we choose every platform, design every environment, and hold ourselves accountable.

ISO 27001aligned controls

Essential 8mapped

Audited stackSOC 2 · ISO · FedRAMP vendors

Due diligenceon every platform

Why this page exists

§01

If you can't verify it, it isn't security.

We do not run tools because they are popular. We run them because they are independently audited, so the controls protecting your business are accountable to someone other than us. Every platform below was chosen through deliberate due diligence and mapped to recognised standards. This is the proof behind the practice: the accreditations our stack holds, shown without the marketing.

Detection & response

§02

The platforms that watch and defend.

Accredited & aligned

Endpoint Detection & Response (EDR / XDR)

Autonomous, AI-driven threat prevention, detection and response across every endpoint, server, cloud workload and identity.

SOC 2 Type IIISO 27001ISO 27017ISO 27018FedRAMP HighIRAP (PROTECTED)

Managed Detection & Response (MDR)

24/7, human-led threat hunting, investigation and response across endpoints, Microsoft 365 and identity.

SOC 2 Type IIGDPRCCPA

Next-Generation Firewall & Network Security

Perimeter and internal network security: inspection, intrusion prevention, secure VPN and web and email filtering.

Common Criteria (NDcPP)EAL4+FIPS 140-2 validatedICSA Labs

Appliance-level evaluations; the vendor’s cloud services additionally hold ISO 27001 and SOC 2.

Backup & continuity

§03

The platforms that make recovery a certainty.

Accredited & aligned

Business Continuity & Disaster Recovery (BCDR)

Image-based local backup with immutable cloud copies and rapid recovery, so a ransomware hit or honest mistake is a bad hour, not a bad year.

SOC 2 Type IIISO 27001

Held at the backup cloud / datacentre layer.

Enterprise Backup & Replication

Backup, replication and assured recovery for virtual, physical and cloud workloads across the environment.

ISO 27001ISO 27017ISO 27018ISO 27701FIPS 140-2 validated

Vendor ISMS and cloud services; the engine itself is configured to these standards.

Direct-to-Cloud Backup

Independent, off-site cloud backup for servers, workstations and Microsoft 365 data.

SOC 2 Type IIISO 27001HIPAA

Cloud, identity & productivity

§04

The platform your business runs on.

Accredited & aligned

Cloud Productivity, Identity & Security Platform

The productivity, identity and security cloud at the core of the modern workplace, with conditional access and least-privilege enforced.

ISO 27001ISO 27017ISO 27018ISO 27701SOC 1 / 2 / 3FedRAMP HighIRAPPCI DSSHITRUST

How we run your IT

§05

The platforms behind our own delivery.

Accredited & aligned

Remote Monitoring & Management (RMM)

How we monitor, patch, automate and manage your fleet, around the clock, at scale.

ISO 27001PCI DSS Level 1SOC 2 Type II

Professional Services Automation (PSA)

The service desk, ticketing, project and billing platform that runs our operations and your support.

SOC 2 Type II

IT Documentation & Asset Management

Structured, secured documentation of your environment, assets and credentials, so knowledge never walks out the door.

SOC 2 Type II

Unified Communications & Business Voice

Business voice, video and contact-centre delivered over SIP, on any device, anywhere.

Aligned to ISO 27001 principles

Endpoint hardware

§06

The devices in your team’s hands.

Accredited & aligned

Business Endpoint Hardware (A)

Commercial-grade laptops and desktops with hardware-rooted security and a managed supply chain.

ISO 27001ISO 27701TPM: Common Criteria EAL4+TPM: FIPS 140-2 Level 2

Manufacturer ISMS; security validations at the trusted-platform-module level.

Business Endpoint Hardware (B)

Commercial laptops and desktops with a built-in platform-security stack and supply-chain assurance.

ISO 9001ISO 14001ISO 27001TAPA FSR (supply-chain security)

Connectivity & carriers

§07

The networks underneath it all.

Accredited & aligned

Enterprise Fibre & Network Carrier

Wholesale and enterprise fibre, network and voice across New Zealand.

ISO 27001ISO 9001

Network and datacentre operations.

Carrier-Grade Mobile & Broadband

Mobile, fixed broadband and business connectivity from a major national carrier.

Carrier-grade national network

Independent Wholesale Network

A pure-wholesale connectivity, voice and WAN platform serving providers across New Zealand.

Independent NZ wholesale network

What the badges mean

§09

The standards, in plain English.

SOC 2 Type II

An independent audit (over time, not a snapshot) of a provider’s security, availability and confidentiality controls.

ISO / IEC 27001

The international standard for an information security management system. Certification means controls are documented, operating and externally audited.

FedRAMP / IRAP

US and Australian government security assessments. Among the most rigorous bars a cloud platform can clear.

Common Criteria / FIPS 140-2

Internationally recognised evaluations of security products and cryptography, used by governments and regulated industries.

PCI DSS

The payment-card industry security standard, required to handle cardholder data safely.

Our own alignment

§10

Accredited platforms are only half of it.

The Belton standard

The best tools in the world do nothing if they are configured carelessly. So we hold ourselves to the same bar we expect of our vendors.

◆

01 / Mapped to standards

Essential Eight & ISO-aligned

We map your environment to the Essential Eight and ISO 27001 principles, with audit-ready evidence you can show a board, an insurer or a buyer.

▣

02 / Due diligence

Vendors who can prove it

We select and review every platform against its published certifications. If a vendor cannot prove its controls, it does not run your environment.

◉

03 / Defence in depth

Layered, not single-point

Identity, endpoint, network, email, backup and monitoring, each accredited, each layered, so one control failing does not become a breach.

A note on accuracy: accreditations reflect each platform’s published certifications and may be held at company, service or component level, and scope varies by product and region. We do not overstate them. We select, configure and review every vendor against these standards, and we are glad to walk you through the detail.

See it for
yourself.

A 90-minute discovery and security session. We map your environment against these standards and show you exactly where you stand.

Book the session ›Talk to a human ›

And relax

Getting started is the easy part.

Onboarding without drama

We do the switch: your current provider, the migration, the handover, all of it. Most teams barely notice the cutover happened.

Everything looked after

On the right plan, compliance, reporting and budgets are handled inside the partnership. You run the business; we run the IT underneath it.

Your QBR writes itself

Quarterly business reviews are generated automatically from your live environment: spend, posture, recommendations and roadmap, ready for the board, reviewed with your account manager.

The honest bit: the full looked-after experience comes with the right plan. We charge fairly for what we take on, and when costs step up it's because you are taking on more, always moving in the right direction.

Get started in 2 minutes › Speak to someone ›

Sovereign by design

New Zealand owned and operated.

Sovereign data centres across New Zealand and Australia, with your data kept onshore wherever it's required. Our team understands New Zealand, and our leaders have built, scaled and secured businesses right across the New Zealand landscape.

Sovereign data centres · New Zealand & Australia

Auckland
Christchurch
Sydney
Melbourne
Brisbane
Perth

International data-centre operations

Singapore
Germany
Netherlands
USA

Servers available in minutes, not days.

Explore data centres & hosting →

Accredited partners

Microsoft Solutions Partner, Modern Work

Fortinet Partner Lenovo Partner HP Partner Apple Business Manager

Proof, not promises.

If you can't verify it, it isn't security.

The platforms that watch and defend.

The platforms that make recovery a certainty.

The platform your business runs on.

The platforms behind our own delivery.

The devices in your team’s hands.

The networks underneath it all.

The standards, in plain English.

Accredited platforms are only half of it.

See it for yourself.

Getting started is the easy part.

New Zealand owned and operated.

See it for
yourself.