Do you know what your website does while you sleep?

We do.

Information security for companies and organisations, to the standard of the large ones. Consulting where it matters: before an incident, during it and after. For small and medium-sized companies, NGOs and institutions that need rigour, not a standard package.

Write to us at office@tcx.ro

Incidents are no longer the exception

A 2026 global study of companies with fewer than 500 employees shows how often small businesses are hit, and what they lose.

86%had at least one cyber incident in the past 12 months

32%saw customer data as the main target

22%suffered financial losses in their most serious incident

16%lost data that could not be recovered

Source: Kaspersky global study of small and medium-sized businesses, reported in the press in October 2026.

The risks we reduce

Small organisations face the same problems as large ones. The difference is that they have no security team. That is where we come in.

Customer data

Customer data, the number one target

Orders, addresses, accounts, documents: what attackers look for first.

we find where the data is, who can see it and how it could leave;
we reduce what is kept, and for how long;
we block unauthorised data leaving your servers.

Details

From experience: A complete test copy of an online shop, made by a supplier and forgotten after an update, was publicly reachable on the same server, with its own login page. We found it from the outside in minutes, exactly as an attacker would have.

Websites and online shops

Compromised or offline websites and shops

Application vulnerabilities, outdated plugins, forgotten code on the server.

we assess the site and server before someone else does;
we update without stopping your business;
we regularly check that checkout and payment work end to end.

Details

From experience: An online shop's theme had a public vulnerability that could be exploited without an account, and the update was delayed. Until it was fixed we put a filter in front of the site that blocks the known attacks without stopping sales, and we check from the outside when the update lands.

Phishing and accounts

Phishing, stolen passwords, financial accounts

A single compromised email account opens the way to money and documents.

email protected against sender forgery (SPF, DKIM, DMARC);
two-step sign-in and password management;
access removed as soon as someone leaves the organisation;
helping your team recognise fraudulent messages.

Details

From experience: Mail servers receive hundreds of password-guessing attempts on real accounts every day. We count them across all servers at once and block the attacker's address after a few failures everywhere, not only on the server it tried.

Ransomware

Ransomware and data lost for good

A backup that has never been restored is not a backup.

copies kept apart from working systems, encrypted;
restores tested regularly, not just "backup done";
a written plan for the day you actually need them.

Details

How we work: Every database backup is automatically restored each night in an isolated environment and compared with the original. If a restore fails or data is missing, we are alerted the next morning, not on the day you actually need the backup.

Third parties

Suppliers, plugins and external services

Access given to a supplier often stays active long after the work has ended.

an inventory of what has access to your systems;
old keys and accounts closed or rotated;
clear security requirements for suppliers.

Details

From experience: On one site, a plugin ran code entered directly from the admin panel, and nobody knew any more who had put it there or why. We inventory access like this, read what it does and close everything that is no longer used.

Control of your IT

Losing control of your IT

Servers, domains and accounts that nobody knows in full any more.

a clear, written picture of what you have and who has access;
monitoring that alerts only on real problems;
documentation that belongs to you and does not tie you to us.

Details

From experience: A domain taken over from another provider kept inherited settings that delayed every change by four hours, and an urgent move "would not propagate". We keep a written, automatically checked map of domains, servers and access, so surprises like this show up before the emergency.

Customer channels

Forms, email and your customer channels

Public forms and addresses are used for spam, fraud and scams.

forms protected against abuse;
your emails reach their recipients, not the spam folder;
nobody can send messages in your name.

Details

From experience: A website's forms failed for two days while the page looked perfectly fine and ordinary monitoring stayed green. Since then we test forms the way a customer would, every day, all the way to the email that actually reaches the recipient.

Private AI and expert systems

Artificial intelligence without giving away your data

Company documents and data sent to public AI services are no longer only yours.

private AI running on your own infrastructure: the data never leaves your organisation;
expert systems that preserve your specialists' knowledge and explain every decision;
clear rules for using AI, and a review of the AI integrations you already have.

Details

How we work: The assistant runs on your servers and only works with the documents it is allowed to see. Nothing leaves for a public service, and every answer can show the sources it was built from.

GDPR

GDPR compliance that actually protects data

Not just paperwork: a breach must be reported within 72 hours, and fines and lost trust follow.

what personal data you hold, where it lives, who can see it and how long it is kept;
the technical measures the regulation asks for, actually in place: encryption, access, logs, deletion on time;
ready for a breach: what happened, which data, what evidence, within the 72 hours;
working together with your lawyer or data protection officer.

Details

From experience: Personal data had been deleted from an old database but still existed in the daily backups, in logs and in a migration copy. We look for it in all these places, not only the obvious one, and verify after deletion that it is gone from each.

Services

One-off or long-term consulting, depending on what your organisation needs.

Security assessment

Websites, servers, email and accounts. You get a report on what is serious, what is urgent and what can wait.

Details

In short: We look at the website, server, email and accounts the way an attacker would, from the outside, then check them from the inside too. You get a report ordered by severity: what must be done today, what this month and what can wait, with concrete steps for each point. Everything we find can be re-checked, including after your supplier says it has been fixed.

Incident response

Compromised site, hacked account, exposed data: we contain the damage, preserve the evidence, restore, and write the report for management and, if needed, for the authorities.

Details

In short: When a site is compromised or an account is breached, the first hours matter. We isolate the system without erasing the traces, keep a complete copy for analysis and bring the service back on a clean base. At the end you get a clear report for management and, where needed, the documentation for notifying the authorities.

Monitoring

An alert when there really is a problem: the shop stops selling, email stops leaving, a file changes on the server.

Details

In short: We do not alert you for every blip. We watch what matters to the business: whether a customer can pay, whether forms reach you, whether email goes out and whether something changed on the server that should not have. Every sensor is tested: we deliberately break what it watches and check that the alert really arrives.

Backup and recovery

Encrypted, separate copies, with tested restores and a written recovery plan.

Details

In short: A backup is only worth its restore. Backups are encrypted, kept apart from working systems and automatically restored every day in an isolated environment. You also get a written plan: what is rebuilt, how fast and in what order.

Email security

Protection against forgery, correct delivery, and your domain's reputation watched continuously.

Details

In short: We configure your domain so nobody can send email in your name (SPF, DKIM, DMARC), then continuously check that messages reach their recipients and not the spam folder. When a receiving server rejects you, you learn why and how to fix it before important correspondence is lost.

Private AI and expert systems

Assistants and models that run on your premises, on your data, and expert systems that turn the experience of key people into repeatable, explainable decisions.

Details

In short: Assistants that work on company documents without those documents leaving for a public service. For decisions that depend on the experience of a few key people, we build expert systems that can repeat and explain them. Your data stays with you, and the reasoning can be checked.

Lossless migrations

Moving websites, email and data to new infrastructure, verified file by file.

Details

In short: We move websites, email and data to new infrastructure without stopping your business. Every file and every database row is verified at the destination, and the switch is made so that going back takes minutes if needed.

GDPR compliance, the technical side

An inventory of personal data, the technical measures put into practice and readiness for a breach, together with your lawyer or data protection officer.

Details

In short: We find out what personal data you hold, where it lives, who can see it and how long it is kept, including in backups and files forgotten on servers. We reduce what is not needed and prepare the response to a breach within the 72-hour deadline, together with your lawyer or data protection officer.

Contact

For an assessment, an ongoing incident or a question:

office@tcx.ro

Integris TCX SRL · VAT RO28148636 · Trade Register J40/2722/2011
Registered office: Calea Victoriei nr. 100, Sector 1, Bucharest, Romania