WebGrow24 home

Company

Infrastructure.

Tools, stack, security posture (ISO 27001), continuity posture (ISO 22301) and quality posture (ISO 9001).

Stack

8 tools across 8 categories. The full WebGrow24 stack.

  • Frontend framework

    Astro 7

    Static-first with hybrid SSR for tool routes. Svelte 5 islands for interactive components. Zero client-side JS by default.

  • Language

    TypeScript 6 strict

    Strict types across the codebase. No JavaScript source files. No any.

  • Styling

    Tailwind CSS 4

    CSS variables for design tokens. Brand colours and spacing from the token layer only.

  • Image optimisation

    Sharp

    Build-time image optimisation via the Astro image pipeline. Serves AVIF and WebP with fallbacks.

  • Site search

    Fuse.js

    Server-side fuzzy search index. Query runs in the browser with zero server calls after initial page load.

  • Hosting

    Dokploy

    Self-managed production, staging and preview environments with auto-deploy on push to master. @astrojs/node standalone adapter.

  • CDN and edge

    Cloudflare

    Global CDN for static assets and edge-rendered pages. DDoS protection, bot management, and free TLS across all routes.

  • Customer communication

    WhatsApp API

    All inbound leads and contact requests route through the WhatsApp business API. No public forms, no email forms.

Security posture (ISO 27001-aligned)

The four pillars of our security posture.

  • ISO 27001-aligned security

    Encrypted at rest and in transit. Role-based access control. Audit logs. Annual penetration tests.

  • Secrets management

    All secrets live in environment variables. The codebase, config files and CI contain no real secrets, IPs, ports or URLs that change between dev and live.

  • Rate limiting

    Per-IP rate limits on every public API route. No public forms — no input surfaces require bot defence.

  • Security headers

    HSTS, X-Content-Type-Options, X-Frame-Options DENY, Referrer-Policy, Permissions-Policy, COOP, COEP. CSP with a SHA-256 hash per inline script and style, no unsafe-inline.

Continuity posture (ISO 22301-aligned)

  • Documented incident response

    Severity levels (P1, P2, P3), response runbooks, weekly review of top errors and unresolved issues logged in our internal issue tracker.

  • Multi-region failover

    Edge-rendered pages serve from the closest region. Multi-region failover for production. Backups run on the Dokploy schedule.

  • Continuous deployment

    Every branch gets a preview URL through Dokploy. The main branch deploys to staging. Release branches deploy to production.

Quality posture (ISO 9001-aligned)

  • Code review

    Every change reviewed against AGENTS.md and specs.md. Every change passes lint, type check and tests before merge.

  • Content as source of truth

    MDX content collections and typed JSON data files. No database. Every page reviewed by a senior before merge and committed to git.

  • Performance budgets

    Home under 240 KB gz first-party JS. Services hub/detail, blog hub/post, tools hub each under 240 KB. Contact under 245 KB. Third-party scripts total under 50 KB gz.

  • Analytics

    GA4 (G-X7GVZ5PH16) on every public page, loaded without a consent gate. No cookie banner.

Verification documents and the full ISO/SOC 2 audit reports are available under NDA on request. Email hello@webgrow24.com.