Security you can verify,
not just claim.
What we recommend, we apply — to your systems just as much as to our own site.
Hardening, least privilege, tested backups, GDPR compliance: Fixery protects the continuity of your business with a high security posture and a reduced attack surface. Without ever promising the impossible.
One point of contact · On-site within 40 km of Poitiers · Remote across mainland France
Security is no longer optional.
Insurers, regulators, software vendors: the rules have tightened. What was best practice yesterday has become a condition for staying covered, compliant and operational.
- Cyber-insurers now require two-factor authentication, ransomware monitoring and genuinely tested backups — without these measures, a claim can be denied.
- The NIS2 directive, written into French law by the act of 30 March 2025, extends cybersecurity obligations to a growing number of organisations and to their subcontractors.
- Since 14 October 2025, Windows 10 is no longer supported: an entire fleet stays exposed until it is upgraded.
The good news: these requirements are within reach — provided they are scoped and followed through.
Sources: ANSSI · Cybermalveillance.gouv.fr · Directive (EU) 2022/2555 (NIS2)
The security we bring to your systems.
One consistent approach across everything we manage: reduce the attack surface, limit access, make backups genuinely reliable, and keep a useful record of what matters.
Hardening
Tightened configurations, unnecessary services switched off, security updates kept current, two-factor authentication on critical access. Fewer open doors, less risk.
Least privilege
Every account gets exactly the rights it needs, nothing more. Administrator access is limited, reviewed regularly and removed as soon as it is no longer useful.
Tested backups
A backup is only reliable once it has been restored. We distinguish verified existing backups, managed backups and genuinely tested restores — so that critical data stays recoverable.
Useful logging
Diagnostic-focused logs, with no excessive data collection and no leaking of secrets: enough to understand an incident and fix it durably, at its root.
The scope always stays explicit: what is covered, what belongs to a project, what falls outside the plan. A non-standard environment — a poorly maintained legacy server, undocumented production Linux, multiple sites — is identified at the diagnostic stage, then scoped.
GDPR, applied simply.
Protecting data starts with collecting as little of it as possible — and knowing exactly why. We apply GDPR without the jargon, to your data as much as to our own.
- Minimisation — we only collect the data a clear purpose requires, never “just in case”.
- Explicit purposes — every piece of data has a reason to exist and a defined retention period.
- Your rights — access, correction and deletion of your personal data, at any time and without friction.
- Vetted processors — hosting and tools chosen for their reliability, with any transfers outside the EU handled under proper safeguards.
The contact form, in plain terms
Name, email, message and, optionally, phone number — for one purpose only: to answer your enquiry. Legal basis: legitimate interest and pre-contractual steps. Retention limited to 3 years after the last business contact. No marketing tracking, no unnecessary cookies.
We build the protection. You keep the good habits.
Technology can’t do it all: most incidents start with a malicious email or a weak password. We train your teams; a few simple habits strengthen the whole chain.
Strong, unique passwords
One password per service, kept in a dedicated password manager, and two-factor authentication wherever it’s available.
Vigilance against phishing
We train your teams to spot suspicious messages. When in doubt, don’t open it — check it. A serious provider will never ask for your password by email.
Report it early
At the first sign of anything odd, speak up rather than wait. An incident caught early costs far less than a breach found too late.
Our own site applies what we recommend.
The best proof of a security posture is being able to check it yourself. Every measure below is publicly verifiable, at any time, with independent audit tools.
Transport & headers
Strict HTTPS, TLS 1.3, HSTS preload, nonce-based CSP, strict Referrer-Policy and Permissions-Policy. Check it via SSL Labs and Mozilla Observatory.
Authenticated DNS & email
DNSSEC enabled, restricted CAA records, SPF, DKIM, DMARC set to reject, MTA-STS and TLS-RPT — against domain spoofing. Check it via Hardenize.
Reduced attack surface
No client portal, no public authentication, no third-party trackers, no marketing scripts. Less exposed code means less risk — by design.
A sound technical base
Controlled performance and accessibility: a clean foundation directly supports security and durability. Check it via Google PageSpeed.
The same standard we hold ourselves to on our own site, we bring to yours — sized to your fleet and the way you work.
Secure, prove, decide.
Three ways in to strengthen your posture and put hard numbers on your risks.
Cybersecurity in Poitiers
Audit, hardening, email security, awareness training and ransomware monitoring.
Explore cybersecurity › Guarantees & insuranceOur guarantees
Professional liability, cyber, legal protection: our commitments and our limits, stated plainly.
See the guarantees › DiagnosticFixery Diagnostic — €290 excl. VAT
An audit of your fleet, your security and your backups — prioritised and costed.
Book the diagnostic ›Security & compliance, no grey areas.
Can you guarantee I’ll never be attacked?
No — and no one honestly can. Our job is to reduce the risk sharply and limit its impact: a high security posture, a reduced attack surface, tested backups and clear incident handling. We talk about managed odds, never zero risk.
Where is the data you handle hosted?
With established hosting providers, with data encrypted in transit and at rest. We limit the data we collect, frame any transfers outside the EU and document our processors — in line with GDPR.
My cyber-insurance requires specific measures. Can you help?
Yes. Two-factor authentication, ransomware monitoring, genuinely tested backups: these are exactly the measures we put in place and maintain. The Diagnostic takes stock of what’s missing to stay covered.
Does the NIS2 directive apply to me?
It depends on your sector and your size. Even outside its direct scope, a small organisation has every reason to align with these practices, which larger clients often pass down the chain. We help you work out where you stand.
What happens in the event of a security incident?
We reduce the exposure, identify the cause, restore a safe state, then fix it durably to remove any recurrence — all documented. Handling is prioritised according to your plan, during business hours and within the covered scope.
Get clarity on your security.
A direct conversation about your posture, or a concrete starting point with a Diagnostic.
[email protected] · +33 6 08 68 44 03 · quick reply during business hours · Poitiers (86)