Entrazure
How this site is built
entrazure.com is a static site. There is no application server, no content management system and no database behind the pages you are reading, so the usual injection and takeover paths do not exist here. Pages are generated at build time and served from Azure Static Web Apps over TLS.
There is no third-party script on the site. Fonts are self-hosted rather than fetched from a font network, analytics are cookieless, and no advertising or marketing tag runs anywhere. That is a security decision as much as a privacy one: every external script is a supply chain you have chosen to trust on every page load.
How the site gets deployed
Changes reach production through a pipeline, never through a portal. Every change is a pull request against a Git repository, reviewed before merge, and deployed by GitHub Actions. The pipeline authenticates to Azure with workload identity federation, which means no Azure client secret or long-lived credential exists in the repository, in the runner, or on anyone’s laptop. Infrastructure is Terraform, so the environment can be rebuilt from source and any drift is visible as a diff.
What happens to what you send us
The contact form posts to an Azure Function we operate, over TLS, and the Function writes the message into our own Odoo CRM. Nothing is handed to a marketing platform on the way. Access to the CRM is limited to the people who answer enquiries, with multi-factor authentication required. What we keep and for how long is set out in the privacy policy.
Email is not a secure channel and we treat it as one that is not. Do not send credentials, private keys, tenant identifiers with secrets attached, or personal information about someone else in a first message. If you need to send us something sensitive during an engagement, we will set up a channel for it.
How we work inside client environments
Named accounts, in your tenant. We work under identities you issue and can revoke, with multi-factor authentication and the least privilege the task needs. We do not share accounts between people, and we do not keep standing production access after an engagement ends.
Everything as code. Landing zones, policy, network and pipelines are written as code and merged through review. Nothing important is clicked in the portal, which is what makes an environment reproducible, reviewable and explainable to an auditor months later.
Azure-native controls. We build on the platform’s own security surface rather than bolting a layer on top of it: Entra ID for identity and conditional access, Azure Policy for guardrails enforced at deployment, Key Vault for secrets, Defender for Cloud for posture and regulatory compliance views, and centralized logging with retention chosen to match the framework you answer to.
Security architecture led by certified security architects. That is why compliance requirements appear inside network and identity diagrams on our engagements rather than in a document written after the build.
Handover includes the security story. You keep the repository, the policy set, the decision record and the remediation backlog. If you end an engagement early, you still hold them.
What we do not claim
Entrazure Technologies does not hold a SOC 2 attestation and is not ISO 27001 certified. We design and build environments that go through those audits, and we produce evidence from pipelines rather than reconstructing it before an audit, but the certificate would be yours, not ours. Anyone who tells you their consultancy’s own certification transfers to your estate is selling you something else.
We are an MSSP and a reseller for Klarvant. Klarvant is a third-party product with its own security posture and its own documentation. Its assurances are theirs to make and we do not restate them as ours.
Report a vulnerability
If you find a flaw in this site or in anything we operate, write to contact@entrazure.com with “security” in the subject line.
Tell us the address, what you did, and what you saw. A proof of concept helps. We acknowledge within one business day, tell you what we found, and tell you when it is fixed.
We do not run a paid bug bounty. We do not pursue researchers who act in good faith: stay within scope, do not access or alter anyone else’s data, do not degrade the service, and give us reasonable time before publishing. If you do that, you have our thanks and, with your permission, credit.
Incidents
If an incident affects a client environment we operate, the notification path and timings are in that engagement contract. If an incident involves personal information, the obligations under Law 25, including notifying the Commission d’accès à l’information and the people affected, are described on the privacy policy page.