The free assessment includes a look at your security posture alongside the rest of your setup, not a standalone penetration test.
Signs you need this
- A client or partner has sent a vendor security questionnaire you cannot answer confidently.
- Nobody has watched the site since it launched, and software and plugins have not been updated.
- Email from your domain lands in spam, or anyone could send mail that appears to come from you.
- Passwords and admin access are shared, and nobody can say who can log in to what.
- An insurer, auditor or scanner has flagged a gap on your domain.
- You rebuilt the site, but hardening stopped at launch.
What is included
- Web and API hardening. WAF, TLS, security headers and DDoS mitigation. The public surface is closed to common attacks.
- Access controls. Zero-trust access and secrets hygiene. Only the right people and systems get in.
- Email authentication. SPF, DKIM and DMARC set up and checked. Mail from your domain is harder to spoof.
- Continuous vulnerability assessment and monitoring. Problems are found before a customer finds them.
- Performance monitoring, backups and health reporting. You see the real state of the system.
- Compliance-gate readiness. Controls aligned to NIST 800-53, built so you can answer a review.
What your client's IT team checks about your domain
When a client looks you up, these are the first things a technical reviewer tends to look at:
- HTTPS everywhere, with a valid certificate and modern TLS.
- Security headers present on your pages.
- SPF, DKIM and DMARC records published and valid for the domain you send from.
- DKIM keys of adequate length (2048-bit rather than 1024-bit).
- No exposed admin panels, default logins or outdated software.
You can check the first three yourself with the free scan below.
Compliance readiness is not certification
| Compliance readiness | Certification | |
|---|---|---|
| What it is | Controls and evidence built so you can answer a review with confidence | A formal attestation against a named standard |
| Who provides it | FEDLIN builds the controls and proves they hold | An independent auditor or certifying body |
| What we claim | Readiness work, monitored and reported | Nothing: we hold and grant no certification for you |
Questionnaire help follows the same rule. We assess your setup, close real gaps and prepare you, without promising how a client's review will turn out.
How it works
The work follows the Continuit Methodology.
- Scope and discovery. We assess your web and API surface, access and email authentication. You share your domains, systems and any questionnaire.
- Build. FEDLIN configures WAF, TLS, headers, access and email authentication. You confirm who needs access to what.
- Security review and launch. A vulnerability assessment and hardening review happen before go-live. You approve the launch.
- Managed operation. We monitor, keep controls current and report. You tell us about new systems and people.
- Graduate as you grow. You add a deeper security program or private infrastructure.
What we do not claim
No security program can promise zero vulnerabilities or guaranteed uptime. We provide real controls, monitored continuously, with regular reporting so you see the actual state of your system. Data handling is described in the privacy policy.
How this connects to the rest of Continuit
Security protects what the other pillars build. Modernize delivers the site, Get Found makes it visible, andAutomate connects it to your tools. For clients who must control where automations run, see Own Your Automation Stack.
Frequently asked questions
Can you help with a vendor security questionnaire?
Yes, that is what FEDLIN's lane exists for. We walk through what a client or partner is actually asking, assess where your web and API infrastructure and access controls stand, and do the hardening work to close real gaps. We will not promise a specific certification or a guaranteed outcome on someone else's review, but you will not walk in unprepared.
Is this a fit for regulated or trust-sensitive industries?
It can be. FEDLIN covers web and API hardening, zero-trust access controls and compliance-gate readiness, which matters when your clients or partners scrutinize who they work with. We do not claim specific certifications or guaranteed compliance outcomes. FEDLIN can speak to your particular regulatory situation on a call, and the right scope depends on it.
What is the difference between compliance readiness and certification?
Readiness means building the controls and evidence so you can answer a questionnaire or audit with confidence. Certification is a formal attestation by an independent body against a named standard. We help with readiness. We do not hold or grant any certification on your behalf, and we will not imply that our work equals one.
Who handles our data, and where does it live?
It depends on the tier. At Tiers 1–3 your site runs on Cloudflare's edge and automation runs on managed platforms, with FEDLIN applying web and API controls at the application layer. At Tier 4 a private infrastructure option lets FEDLIN source, provision and harden in-boundary hosting so data stays in your environment.
What does monitoring include, and how often will I hear from you?
Monitoring covers continuous vulnerability assessment plus performance, backups and health checks. Clients receive a report every month so they can see the real state of their system. No program can promise zero vulnerabilities or guaranteed uptime. Alert response times are set in your statement of work.
Is the free scan on this page a security audit?
No. The free scan reads only what is visible from outside: security headers, email authentication and post-quantum TLS readiness. It cannot see internal systems, code or a full cryptographic inventory. Use it as a quick first look, then treat a proper assessment as the way to find what a public scan cannot.
Further reading
Start with the free assessment, or read the general FAQ first.
More answers are in the general FAQ.