Your own access path
A named, MFA-protected account on your VPN, Azure Bastion, Azure Virtual Desktop or Citrix. Cloud consoles are reached in a browser with a time-limited role. Nothing new is installed on your side.
Information Technology Consulting
Build secure. Move faster.
Information technology consulting, ordered by business criticality.
FlowCraft AI services come first: the security gap assessment, then the identity, cloud, server, recovery and governance work it usually leads to. Automation, AI agents and analytics follow. Scope and boundaries are fixed in writing before work starts.
01 · FlowCraft AI services
Deploy, harden and govern
- Core systems the business cannot afford to lose
- Flow repeatable operations with friction removed
- Signal trusted data shaped for decisions
01Microsoft 365, Entra ID and Azure
The identity and cloud control plane4 services
Microsoft 365 and Entra ID setup Core
An identity-first tenant baseline: verified domains, users and groups, Conditional Access, phishing-resistant MFA, break-glass accounts, PIM for admin roles and audit logging.
Azure landing zone Core
A governed Azure estate with subscriptions, management groups, RBAC, Azure Policy, private networking, Key Vault, Log Analytics and cost alerts, codified in Bicep or Terraform.
Intune and device management Core
Devices enrolled into compliance and configuration baselines, with Windows Update rings, BitLocker and controlled application delivery.
Exchange Online and email setup Core
Mail flow engineered with SPF, DKIM and DMARC progressing to reject, plus shared mailboxes and retention controls.
02Windows and server operations
Compute built to carry the business6 services
End-to-end deployment Core
Provisioning, configuration, software and security-control deployment, testing and handover, run by FlowCraft AI inside your approved change window.
Server hardening (CIS) Core
Windows and Linux servers brought to the applicable CIS Benchmark, with every deviation either fixed or recorded as an accepted exception.
Health and compliance check Flow
A recurring read-only check of patch level, services, certificates, disk, backup status and baseline drift, with a short report of what changed.
Windows Server and Active Directory build Core
Domain controllers, DNS, DHCP and group policy arranged around a tiered administration model.
Linux server build Core
Ubuntu and RHEL builds with SSH key-only access, host firewall policy, patch orchestration and monitoring agents from first boot.
Server migration and upgrades Flow
Controlled moves to Azure or newer operating systems, executed inside your approved window with a tested rollback path.
03Backup and recovery
Recovery engineered before the crisis2 services
Backup design and setup Core
Azure Backup, Microsoft 365 backup or your existing platform arranged around immutable, isolated copies that production credentials cannot silently erase.
Restore testing and runbooks Core
Documented restore exercises measured against your RTO and RPO targets, with evidence retained for audit and operational rehearsal.
04Incident response
Clarity when something has already gone wrong2 services
DFIR and incident investigation Core
Evidence preservation, triage, timeline and root cause across endpoint, identity, email and cloud logs. Containment, eradication and recovery steps run only with your approval, then the controls are re-checked.
Incident response tabletop exercises Flow
A realistic scenario rehearsed with your technical and management teams, scored against your plan, with gaps and owners recorded.
05Security operations builds
Turning telemetry into time to act5 services
Detection engineering Flow
MITRE ATT&CK-aligned use cases for Microsoft Sentinel, Defender XDR, Splunk or Elastic, with query logic, tuning and test evidence.
Detection tuning and false-positive reduction Flow
Noisy rules re-engineered with allow-lists, thresholds and enrichment so analysts spend time on alerts that matter.
SIEM dashboards and workbooks Signal
Sentinel workbooks, Splunk or Elastic dashboards for coverage, alert trends, analyst workload and ingestion health.
Security automation and SOAR playbooks Flow
Logic Apps, Sentinel automation rules and SOAR playbooks for enrichment and response, with approval gates, least privilege and no hard-coded secrets.
Log retention and cost optimisation Flow
Tiered retention, filtering and table plans that cut ingestion cost without losing the evidence investigations need.
06Governance, audit and compliance
Make the environment easier to govern4 services
Policy and standard update Flow
Policies, standards and baselines aligned to your chosen framework, with a control-mapped change log.
Audit document review and update Flow
In-scope documents reviewed and updated through edit access to named files only, with tracked changes and your approval.
Compliance evidence register Flow
Evidence mapped to controls and marked Met, Partial or Not Met, ready for internal or external audit.
Security design review Flow
Pre-launch scrutiny of data flows, trust boundaries, identity, logging and resilience, with Critical-to-Low findings and HLD and LLD documentation.
02 · Additional services
Automate, analyse and repair
Also available as fixed-scope projects on Upwork and Fiverr.
07Workflow automation and integration
Repetitive work converted into governed flow3 services
Workflow automation (n8n and Power Automate) Flow
n8n, Power Automate, Azure Logic Apps, Make or Zapier workflows, mapped before they are built, tested before release and instrumented to alert your team on failure.
Systems integration Flow
API bridges across CRM, ERP, ticketing and Microsoft 365, using least-privilege service identities and secret stores, not credentials embedded in code.
Scripting and IT automation Flow
PowerShell and Python for provisioning, reporting and recurring administration, with logging, explicit failure states and safe defaults.
08AI agents and RAG solutions
Machine acceleration inside a human boundary2 services
AI agents Flow
Email triage, document extraction and drafting agents bounded by guardrails, prompt-injection checks, audit trails and a human approval step before consequential action.
RAG knowledge assistants Flow
Grounded answers from your own policies and documents, with source citations, freshness checks and permissions that mirror what each person may already see.
09Power BI reports and data models
Signal leaders can interrogate and trust2 services
Power BI dashboards Signal
Star-schema semantic models, tested DAX measures, row-level security and scheduled refresh, built for explanation as well as presentation.
Management reporting Signal
KPI views for leadership and operations, shaped from governed data with definitions teams can defend.
10Data classification, analysis and database design
A trustworthy substrate beneath every decision3 services
Data classification Signal
Sensitivity labels and handling rules applied to your data estate, ready to drive DLP and access decisions.
Data analysis and pipelines Signal
Microsoft Fabric, Azure Data Factory or Python pipelines with validation at the seams, failure alerts and documented lineage.
Database design and migration Signal
Normalised schemas, indexing and controlled migration between systems, closed with reconciliation reports that expose every unresolved difference.
11Diagnose, repair or rescue
When something built elsewhere has stopped working1 service
Diagnosis and repair Flow
A written reading of a broken automation, dashboard or configuration: root cause, repair options separated and each fix quoted individually.
Remote delivery
We come to your environment. Your data stays there.
When work happens inside your systems, it happens through a session you control. Only screen and keyboard traffic crosses the connection; your files, databases and mailboxes stay on your systems. We keep only the deliverables you agree to receive.
Attended remote session
For smaller environments, a commercial remote-support tool with session logging. You start the session, watch it and can end it at any time.
Our tooling stays on our side
The FlowCraft AI agent and browser extension run on our own hardened workstation and work through the session. No Flowcraft agent is installed on your systems.
- Sessions are not recorded or stored by Flowcraft unless you ask for a recording.
- FlowCraft AI reads the session screen to assist. That screen content is processed by enterprise AI services under terms that exclude training on your data. You can ask for any engagement to be delivered without AI.
- Access is removed at handover, and any working data we hold is deleted within 14 days of close.
The engagement envelope
- Your administrator provisions scoped, time-boxed access; passwords never travel through chat.
- Your API keys, your accounts, your tenant. Client data does not migrate into ours.
- Where appropriate, Bicep, Terraform or PowerShell captures the infrastructure in your repository.
- Documentation and handover are included, followed by 14 days of defect correction after acceptance.
- Access is removed and working data deleted within 14 days of engagement close.
Deliberate boundaries
- No penetration testing or red-team operations.
- No managed SOC, 24×7 monitoring or incident-response retainer.
- No hosted software and no custody of your production data.
Need the exposure map before the build plan? Begin with the security gap assessment.
Show us the system that must not fail.
Tell us what it carries, where it catches and what has to change. We reply within one business day with the shape of a scope.