Going to production

Releasing a change shouldn't be scary. Nor leaving security out.

Your system in the cloud, on your own servers or both, with releases that can be rolled back, security checked on every change, costs you can understand and a trail of everything. For operations that cannot stop.

Let's talk about your case

Prefer email? Write to us at hola@habil.mx

Trusted by organizations where continuity and security are non-negotiable

  • BanCoppel
  • Zurich
  • Allianz
  • GNP Seguros
  • MetLife
  • Costco
  • Seguros Multiva
  • Aserta
  • Bx+
  • Veolia
  • Truper
  • Argos

The problem is rarely the cloud: it's how you release

Critical systems don't go down for lack of servers: they go down on release day, because of a change nobody tested the same way as in production or a setting someone changed by hand. And when security is a review at the end, one of two things happens: either it slows everything down, or people skip it. The way out is the same for both: an automated path where tests and security happen on their own, on every change, and stop only what is truly a risk.

Example illustration: a release passing through its gates.

Symptoms your operation already recognizes

  • “Releases happen in the middle of the night, with everyone on the call.”

    Technologyevery change is a risk event, so changes pile up and become bigger and riskier.

  • “Nobody knows exactly what is running in production.”

    Hand-made configurations and environments that don't resemble each other.

    Operationswhat worked in testing fails in production.

  • “The auditor asks for evidence and it takes us weeks.”

    Compliancethe same findings, year after year.

  • “There are passwords written in configuration files.”

    Technologyone leaked backup or repository is enough to expose them.

  • “We use libraries nobody reviews.”

    Technologya public vulnerability in a dependency reaches production without anyone knowing.

  • “The cloud bill keeps going up and nobody knows why.”

    Financea cost that grows while the business doesn't.

  • “Security and development get in each other's way.”

    Executive managementreleases held up by manual reviews.

  • “If our specialist leaves, operations are put at risk.”

    Executive managementcritical dependence on one key person.

  • “We find out about the failure from the customer.”

    Digital leadershipno alerts before the user notices.

Why now?

Every new digital channel multiplies releases. If today you release once a month with fear, with twice the channels you won't release twice as much: you'll release with twice the fear, and with twice the doors for a security risk.

What we offer

  • A release path implemented from scratch.

    Every change goes out through the same automated path, with tests and security analysis before it reaches production, and with an agreed rollback; with the tool your team already uses: GitHub Actions, GitLab CI, Jenkins, Azure DevOps or AWS services (CodePipeline, CodeBuild).

  • Automatic security review on every change:

    code quality, vulnerabilities in your own code, in dependencies and in container images, before reaching production.

  • Rules that stop only what is serious:

    critical issues don't get through; minor ones are recorded and handled without slowing down.

  • Passwords and keys under lock and key:

    out of the code and the files, with role-based access and rotation.

  • Environments that match each other:

    testing, staging and production described as code —Terraform for the infrastructure and Ansible for server configuration—: what was tested is what gets released.

  • In the cloud, on your servers or both.

    Native solutions on AWS, Azure and Google Cloud —serverless, 100% as a service or on Kubernetes—, or in your data center; we design considering your regulatory obligations, your policies and your costs; we don't sell you a cloud. Built by architects trained in the AWS cloud who have operated it in banking and insurance.

  • Your system where it already runs, without forced moves.

    We integrate it, release it and, if you need it, operate it where it is —WebLogic, WebSphere, JBoss or Tomcat, on Red Hat Enterprise Linux or Ubuntu—, without demanding a risky migration to start.

  • Resilience and portability:

    your system packaged to run the same way in any environment and recover on its own from common failures (containers and orchestration).

  • See it before the customer does:

    telemetry —metrics, logs, traces and alerts— to detect and act on the signs of a failure before they affect more users.

  • Protected entry points:

    certificates, application firewalls and hardening of servers and containers.

  • Costs you can explain:

    what each service consumes and how much, so you decide with numbers.

  • Knowledge transfer:

    documentation and enablement so your team can run what we build without depending on us.

For your technology team: Kubernetes (also on your servers, with Rancher), containers, Terraform and Ansible, event messaging, telemetry, static analysis of code and dependencies, image scanning, secrets management; on AWS, Azure, Google Cloud or your data center. Our team has operated perimeter security with F5 BIG-IP and Imperva.

Further reading

What your Compliance area receives

Every release records who approved it, what was reviewed and what went out; access is by role and logged; the vulnerabilities found, with their decision. Evidence you can consult, without hunting for it in emails.

How we work

First we measure how you release today: how long it takes, how often it fails, what is done by hand and what your security process checks. Then we automate one system at a time, starting with the one that hurts most, with operations running and an agreed rollback.

What we've already done

  • A global insurer, on Kubernetes in its own infrastructure

    with built-in security, within a regulated sector.

  • A single release path for an entire platform:

    more than thirty services go out through the same process, with code quality, scanning of vulnerabilities and secrets in every image (including its dependencies) and tests before every release; critical issues don't get through.

  • A bank's digital account opening

    with cloud functions exposed as APIs, managed databases and private links to its data center.

  • An e-commerce testing environment, replicated exactly

    so that what works in testing works the same in production.

  • IT audit for a bank's certification:

    verification of its core system and its anti-money-laundering system.

Since 2019 we have set up corporate release paths, with testing and an audit trail, on the client's own infrastructure.

The assessment

  1. Entry deliverable — Map of the path to production:

    bottlenecks and risks in your move to production, what your security process checks and where to start. Your technology lead and whoever releases today take part.

  2. In-depth assessment, with an agreed scope:

    a map of environments, release and security risks, missing evidence, cost and a roadmap in stages.

Frequently asked questions

Do you make us move to the cloud?
No. We design in the cloud, on your servers or both, depending on your regulations and your costs.
Do we have to stop operations?
No. In stages, with an agreed rollback.
Will this slow my team down?
No: the review is automatic and stops only what is serious.
Does it help with the audit?
Every release leaves evidence you can consult, which eases the review by your Compliance area and your auditor.
Do we have to change our tools?
Not necessarily: we start with the ones you already use.
Who runs it afterwards?
Your team, with the documentation; or us, if you so agree.

Start by finding out what happens on release day

Let's choose a priority system together: in the first conversation, at no cost, we review how you release today and you take away a map of your risks, your controls and your next decision.

Let's talk about your case

Prefer email? Write to us at hola@habil.mx

If what you need to launch is a product or a rate, there is no need for another path to production: Retícula is delivered operated by Hábil.

Explore Retícula