White labelTechnology and media

Secure sign-in

One secure entry point for a public network platform

A network technology company needed its public platform, its API layer, and its content system protected to a standard that would survive independent penetration testing. Symph replaced service-by-service protection with a single managed edge in front of three services.

We keep this client’s name private. The client is real, and so is the system.

At a glance

Cloud hosting architecture, edge routing, and web application firewall policy for a three-service platform

Client: A network technology company operating a public customer platform in Southeast Asia
Industry: Network technology
Engagement: Platform hosting, security operations, and release management

The challenge

The platform was not one application. It was three, and each one faced the internet differently.

Three surfaces, three risk profiles
A customer-facing web app, an API middleware layer, and a content management system each needed different handling at the edge.
Application-level protection does not scale
Filtering hostile traffic inside each service means writing the same defence three times and maintaining it three times.
Independent testing was coming
An external cybersecurity team was commissioned to run a vulnerability assessment and penetration test against the live domain.
Strong defences can hide real findings
A firewall that blocks every injection and scanner probe produces a clean-looking report that proves nothing about the application underneath.
Changes at the edge are high risk
A wrong rule at the single entry point takes the whole platform offline, so edge changes needed a verified, reversible process.

How we built it

Symph worked in three steps, each one building on the last.

Consolidate the entry point
Symph put a single global HTTPS load balancer in front of the platform. It redirects the bare domain to the canonical hostname and routes by path, sending site traffic to the frontend and API calls to the middleware.
Push security to the edge
A managed web application firewall policy now guards the frontend and API layer, with a separate policy and rate limit for the content and backend surface. Protection is configured once at the edge instead of repeatedly inside each service.
Make assessment and release safe
Symph built a controlled, time-boxed process for opening the edge to an authorised testing team, with removal steps prepared in advance. Code reaches production through tagged releases in each repository.

Modules

01
Edge routing
Single managed entry point with canonical hostname redirect and path-based routing to three backend services.
02
Customer web application
The public, content-managed experience customers interact with.
03
API and middleware layer
Handles application requests on a dedicated path and its own backend service.
04
Content management and backend
Lets the client’s team manage public content, behind its own protection policy.
05
Web application firewall policy
Managed rules covering injection, cross-site scripting, remote code execution, file inclusion, scanner probes, and session attacks, plus request throttling.
06
Release management
Tagged releases across the application and content repositories control what reaches production.

Delivery model

01
Ongoing platform engagement
Symph owns hosting architecture, edge security policy, and release promotion rather than a one-time handover.
02
Change-controlled edge
Edge and firewall changes are prepared, verified, and reversible, with removal steps written before activation.
03
Assessment support on request
Symph configures and then withdraws controlled access for authorised third-party security testing windows.

How it’s built

Proven architecture

The platform runs on Symph’s standard Google Cloud stack, built for security, reliability, and easy maintenance.

Secure by default

A managed web application firewall, rate limiting, strict access controls, and encryption protect the platform’s users. Symph follows OWASP-aligned practices and the Philippine Data Privacy Act.

AI-native delivery

Symph’s engineers build and review with AI coding tools like Claude Code and OpenAI Codex, which shortens both delivery and infrastructure review cycles.

Application: Next.jsNestJSHeadless CMSOpenAPI
Google Cloud: Google CloudGlobal HTTPS Load BalancingCloud ArmorCloud RunSecret ManagerCloud LoggingIAM
Delivery and monitoring: Cloud BuildGitHub
AI-native development: Claude CodeOpenAI Codex

The result

Three services, one protected entry point, and a platform that can be independently tested without hiding its own findings.

33services behind one managed edge

One place to defend
All public traffic enters through a single managed edge, so protection is configured and audited once.
Separate policies for separate risk
The customer app and API layer are governed independently from the content and backend surface.
Testable in production
An authorised assessment team can reach the application itself during a controlled window.
Reversible by design
Every edge change is prepared with its rollback before it is applied.