The ThreatStream mobile app links to the Optic Threat Intelligence Platform, providing access to dashboards, indicators, alerts, and trends.


Innovative design featuring interactive charts, real-time alerts, and trend visualisations.

Compatible with Apple’s fingerprint sensor for secure access.

Includes Multi-Factor Authentication (MFA) for enhanced security.

The current system was confusing and difficult to navigate. The system also made data analysis difficult and challenging to draw meaningful conclusions.




Threat Steam customers heavily rely on the insights that the system provides. However, delivery of that data needed to be more seamless. The system needed to be accessible on widely used mobile devices so that when a threat is uncovered, action can be taken as soon as possible. With the emergence of new technologies such as wearables becoming more mainstream, the system had to be flexible and scalable to accommodate.




The system collects a large amount of data about the network but it was very scattered to be useful and draw meaningful conclusions..

Key Problems


Provides full access to the ThreatStream Optic threat intelligence platform dashboard to display and enable users to take actions with a simple tap of the screen or voice command.




Shows various key performance indicators to assess network health and threats.




Enable security operations centre (SOC) analysts to receive and respond to threat alerts triggered by the Optic platform regardless of where they are. Using the app, anyone wearing an Apple Watch or using an iPhone or iPad, can receive notifications and alerts in real-time, untethering from the displays of their security controls without jeopardizing their ability to see and respond to threats immediately.

How We Solved It

ThreatStream Mobile and Watch App

A comprehensive platform that encompasses an entire ecosystem for delivering and managing offerings, providing end users with a seamless experience when booking Health & Wellness treatments in the comfort of their own home.

Admin CMS: Backend platform (CMS) for admin users to manage treatments, therapist bookings, and customer data.

User App: Frontend mobile app for customers to choose treatment bookings for themselves or anyone else.

Therapist App: Frontend mobile app for therapists who provides treatment services to manage their schedule & bookings as per customer needs.


Ensuring the app’s mobile client and the CMS-based admin interface stay in sync.




Ensuring the app works seamlessly across both iOS and Android platform.




Developing a seamless experience for users booking treatments for multiple people at once.




Implementing secure payment gateways for credit and debit card.




Integrating location-based services to ensure users can book treatments within their specific serviceable areas.




Ensuring that the app reflects real-time data on bookings, services, and user actions.


By developing the app using React Native, we ensured that the app would work on both iOS and Android devices, while ensuring a consistent user experience across platforms.




We implemented REST APIs to enable real-time synchronization of data between the mobile app, backend, and CMS. This ensures that any changes made (e.g., booking status, profile updates) are instantly reflected in the app.




The app uses industry-standard encryption protocols to handle sensitive information.




The app leverages GPS to offer users available treatments within their location, improving the booking experience based on proximity.

Cocon - Home Massage & Spa

We partnered with an EU-based AI start-up to deliver a cloud-native, GDPR-compliant meeting intelligence platform that transforms voice data into structured outputs such as summaries and transcripts. The system was designed from the ground up with strong security and data protection principles, enabling secure and efficient processing of audio data while supporting cost-efficient scalability. To validate our implementation, a leading independent security firm conducted a comprehensive penetration test across application, API, and cloud infrastructure layers.

 Some architectural and implementation details have been intentionally generalised or omitted due to security and confidentiality considerations.

Build secure foundations aligned with GDPR and enterprise security expectations

Design encrypted boundaries and strong identity controls from day one

Enable safe handling of sensitive user-generated voice content

Pass an independent third-party penetration test before enterprise onboarding

Maintain strong security posture without relying on expensive vendor tooling

Processing large-scale voice data and converting it into structured, user-linked information

Protecting sensitive content under strict European privacy regulations

Securing APIs used for transcription and content analysis workflows

Ensuring data and access separation between different customer teams

From the start, the system followed a "Secure by Design, Efficient by Default" approach:

Leveraged open-source components and built-in cloud-native controls

Applied encryption across service boundaries

Practised least-privilege access and secure defaults

Included threat modelling during the architecture phase

The infrastructure was built using Azure Virtual Machines, Function Apps, managed Postgres databases, and Azure Storage, integrated via secure cloud-native patterns. Front-ends were implemented using web and mobile clients.

A third-party security firm conducted a comprehensive assessment, which included:

 – external attack simulations without prior code access

 – in-depth code and configuration review

 – validation of infrastructure setup against best practices

Backend APIs developed using a combination of open technologies, including Node.js and Python, exposed securely via Azure API Gateway

Azure infrastructure components including VMs, Function Apps, Web Apps, managed databases, Azure Storage, and network resources

Vulnerability testing based on OWASP Top 10:

Injection, Insecure Design, Security Misconfiguration

Vulnerable Components, Identification Failures, SSRF, and others

Attempted escalation to system, database, or OS access

Misconfiguration checks based on Microsoft Secure Score and CIS Benchmarks

Our Approach

Lack of HSTS headers, which could increase the chance of insecure connections in specific edge cases

Presence of plaintext credentials in a development repository, which have since been removed

We remediated the identified low-risk issues based on the recommendations provided. These updates were applied internally.

Findings and Remediation

All critical and high-severity issues were resolved within two weeks

Platform passed internal security review and GDPR audit

Enabled rollout to enterprise pilot customers with confidence

Helped establish a formal vulnerability management processPassed third-party penetration test with 

Authentication, access control, and encryption validated as robust

Azure environment aligned with Microsoft and CIS best practices

Enabled enterprise rollout with security confidence

Delivered a secure system while avoiding recurring costs of commercial vendor tools

By embedding security from the architecture phase and leveraging open standards and cloud-native controls, we delivered a production-ready, secure platform. Independent validation confirmed its resilience and demonstrated that strong security can coexist with cost efficiency.

Outcome

 Secure by Design: AI Transcripts Platform

AI Workspace enables you to create dynamic workspaces where you can upload documents, PDFs, audio, and video files, and interact with them seamlessly through generative AI. Designed to boost productivity and simplify workflows, it's your all-in-one hub for intelligent file management and conversational insights.


Workspace Personalisation: Users can create dynamic, customisable workspaces tailored to their needs. Each workspace allows you to add various data sources like URLs, documents, and cloud folders.

AI Assistance in Workspace: Built-in AI enables users to query about uploaded files and links, generating relevant responses. The AI is trained to offer insights and summaries from user-provided content.

Security and Encryption: End-to-end encryption for all communications between the backend and frontend, ensuring the confidentiality of user data. Each user account is isolated to prevent unauthorised access to other users' data.

AI-Powered Interactions: Similar to a chatbot, users can converse with the integrated AI to get answers, summaries, and insights from their files and data.


Protecting user-uploaded data and ensuring that no one (including the backend team) could access or view another user’s files or chats. Ensuring that all user data remained private, secure, and isolated was crucial without compromising the user experience.




The AI would need to pull relevant insights from a variety of document types and offer coherent responses. Balancing accuracy with speed and relevance likely posed a significant challenge.




Translating a cluttered workspace into a simplified, user-friendly interface was challenging. Making the AI feel like a "slightly forgetful but well-meaning assistant" required continuous iteration to find the balance between usability and functionality.


Security considerations were integral from the start. End-to-end encryption for communication and data transfer was implemented. Additionally, data isolation mechanisms ensured users felt in control of their data.




The development team implemented advanced NLP models and document parsers that could process varied file types. Regular updates and feedback mechanisms helped improve AI accuracy.




Given the app’s focus on simplifying complex workflows, designing an intuitive and easy-to-navigate interface while supporting advanced features like multiple workspaces, dynamic file uploads, and AI-driven conversations required significant UX/UI work.

AI Workspace

This project empowers users to craft magical stories for kids, complete with dynamically generated images tailored to the story's summary and the child's profile. Bring tales to life with audio narration options, making story-time more engaging and personalised. A perfect blend of creativity and technology to spark imagination! Key Features:


Storytelling app with audio narration, interactive elements, and user-generated story customization.

Parental controls and subscription-based model.

Multi-language support, offline access, and accessibility features for children with special needs.

Offline access to downloaded stories for uninterrupted usage. 

Feedback mechanism for parents to suggest improvements or request specific story themes.


The primary challenge was creating an app that could captivate young children (3-10 years) while also meeting the needs of parents for privacy, security, and ease of use.




Ensuring the app complied with strict privacy laws like COPPA & GDPR, given the target audience of children and the need for sensitive data handling.




Ensuring that the storytelling experience was engaging and interactive, with features like animations, audio narration, and personalized stories based on user inputs.




Ensuring the app worked smoothly across various iOS and Android devices with different screen sizes, resolutions, and hardware capabilities.


Designed a child-friendly interface with vibrant colors, clear navigation, and engaging animations that would appeal to children while also being simple enough for parents to set up and manage.




Implemented encryption for sensitive user data, limited personal information collection, and ensured clear consent from parents to comply with COPPA and GDPR.




Developed parental controls to manage subscriptions, monitor usage, and provide feedback on the content.




Ensured compatibility across a variety of devices (iOS and Android) and screen sizes, allowing for a seamless user experience.

AI Kids Story

This project redefines note-taking by combining traditional note creation with cutting-edge generative AI. Users can create notes, listen to transcription audio, and engage in conversations with their notes to extract insights or ideas. Generate documents and other materials effortlessly, making your notes more powerful and interactive than ever.


Record audio notes and automatically transcribe them into text with high accuracy.

Convert written notes into natural-sounding speech, with adjustable playback speed, pause, and rewind.

The app supports text summarization and content extraction based on user prompts, enhancing productivity and quick information retrieval.

Efficient search and filtering options to find specific notes quickly.

Developing an AI-powered chat that provides meaningful and contextually accurate responses to user queries related to notes.




Creating an intuitive and seamless user interface that accommodates advanced features while remaining user-friendly for people of all technical skill levels.




Ensuring the app works seamlessly across different platforms (Android, iOS), with features like Apple authentication and Face ID on iOS, while maintaining consistency in user experience.




Ensuring accurate voice-to-text & voice-to-text transcription in real-time with varying accents or without lag or loss of information.


The AI system was powered by a combination of natural language processing (NLP) techniques and machine learning models. We developed specific algorithms to match user queries with relevant note content.




A design-first approach was taken, working closely with user feedback and conducting usability testing to ensure the app’s interface was intuitive, aesthetically pleasing, and easy to navigate.




We used cross-platform development tools (React Native) to ensure that the app provides a consistent user experience across iOS and Android, with special attention to platform-specific features like Apple Face ID.

 AI Voice Notes

daksha

ocdlab

cocon

yamaha

Artificial Intelligence (AI) is transforming the way we work, communicate, and make decisions. From chatbots to automation tools, AI is becoming an essential part of modern productivity. But with this progress comes a growing concern: 

how safe is your personal data in AI systems?

The Privacy Paradox: AI’s Double-Edged Sword

AI models learn from vast amounts of data, including conversations, documents, and behavioral patterns. Even if you don’t share direct identifiers (name, phone number, etc.), AI can still profile you based on your activity. While manually removing PII from every interaction is an option, it’s time-consuming and impractical, especially for businesses handling large amounts of data.

Data breaches, leaks, and unethical data practices by major companies have already shown that sensitive information isn’t always handled as securely as we assume.

Privacy vs. Productivity: The Dilemma (and the FOMO)

In today’s digital world, there’s a growing 

tension between using AI for efficiency and ensuring privacy protection.

 Businesses and individuals who don’t adopt AI risk being less productive in an AI-driven world.

Using AI without precautions can be risky.

 Feeding sensitive data into AI tools without safeguards can expose personal and confidential information.

Compliance laws like GDPR, HIPAA, and CCPA exist, but they are often reactive rather than preventive. 

 While users and organizations can try to remove sensitive data themselves, this is 

a time-consuming process that isn’t scalable.

While everyone is vulnerable to AI-driven profiling, some industries face 

 – Customer financial records, transaction histories, credit scores

 – Patient records, medical histories, prescription data

 – Confidential contracts, case files, sensitive communications

 – Personally identifiable information (PII) shared in conversations

 to leverage AI without exposing sensitive information.

How Businesses Can Protect Data Without Losing AI’s Benefits

The key to balancing AI innovation with privacy concerns lies in PII obfuscation and smart data handling strategies. Here are a few actionable steps businesses can take:

Before feeding data into AI systems, businesses should use encryption, tokenization, and anonymization techniques. This ensures AI models never directly process raw personal information, reducing compliance risks.

Instead of treating privacy as an afterthought, integrate privacy-first principles into every AI-driven workflow. Build AI models with minimal data collection and ensure transparent consent mechanisms for users.

Use Federated Learning to Train AI Without Exposing Data: 

Federated learning allows businesses to train AI models across decentralized devices without moving sensitive data to a central location. This reduces exposure while still enabling AI to learn from diverse datasets.

Apply Differential Privacy for Added Security: 

Differential privacy techniques introduce mathematical noise into datasets, preventing AI from identifying individuals while still allowing useful insights. This ensures data remains statistically valuable but privacy-safe.

Instead of real customer data, companies can generate synthetic datasets that retain the statistical properties of original data while eliminating direct PII exposure.

Waiting for data privacy regulations to catch up is a risky game. Instead, businesses should proactively comply with frameworks like GDPR and HIPAA, even if they aren’t currently required to.

Educate Employees & Customers on AI Privacy: 

A company’s approach to AI privacy is only as strong as its weakest link. Employees handling data should receive continuous training on privacy policies, and customers should be informed about how their data is being used.

Conclusion: Future-Proofing AI-Powered Businesses

AI is an unstoppable force in modern business, but privacy risks don’t have to be a byproduct of progress. By implementing PII obfuscation, following privacy-by-design principles, and embracing AI security best practices, businesses can enjoy the best of both worlds, innovation and trust.

The question is no longer whether businesses should prioritise data privacy, but rather how quickly they can adapt to do so effectively.

Would love to hear your thoughts! How do you approach privacy when using AI tools?

#DataPrivacy #AI #CyberSecurity #PIIProtection #AICompliance #PrivacyMatters

AI is Growing But So Are the Risks to Your Personal Data

In today’s digital landscape, security threats are evolving rapidly, and 

 are at risk. Cybercriminals are no longer just targeting large corporations, 

any organisation that handles sensitive data can be vulnerable

limited budgets, lack of technical expertise, or uncertainty about which protections are necessary

At the same time, advancements in technology, including AI have changed the way security threats emerge. 

. While AI-powered threats exist, businesses don’t need expensive, cutting-edge defenses to stay protected. 

Fundamental security measures still make the biggest difference.

 are too costly to be a viable option. But does that mean they must operate blindly when it comes to security? 

 There are clear steps that businesses can take to 

assess security, verify essential protections, and ensure that their software providers meet basic security standards without requiring deep technical knowledge or expensive audits

how businesses can verify security without costly third-party audits

how to strike the right balance between security and cost

How Clients Can Ensure Basic Security Without Third-Party Audits

While external security audits offer deep insights, they can be expensive. However, clients can still take 

 to ensure their software provider follows essential security practices.

Request a Security Checklist from the Vendor: 

Clients should ask for a self-assessed security checklist covering:

Ask if your data is protected when stored (at rest) and when sent over the internet (in transit).

Check whether the system uses strong login protections like two-factor authentication or role-based access control.

What happens to my data if I stop using the service? 

Ask how long your data will be retained and how it is deleted or removed from the system.

Is the system protected against common cyber risks? 

Find out whether APIs and inputs are secured against common threats, and if known vulnerabilities are actively addressed.

Are you following any data protection regulations? 

Ask whether the provider complies with applicable laws such as GDPR or other regional data privacy rules.

Do you have a plan if something goes wrong? 

Ask for a basic outline of how the provider handles security incidents like data breaches or service disruptions.



 A reliable provider should be transparent about their security measures. If they cannot provide basic details, it’s a red flag.

Without technical expertise, clients can still check security configurations using free tools:

Website security scanners to check SSL/TLS encryption

Privacy policy analyzers to assess data handling practices

Basic vulnerability scanning tools (for tech-savvy users)

 Poor security scores indicate weak protections, even if the software seems functional.

3.  Review the Privacy Policy & Data Handling Practices: 

A trustworthy software provider should have a basic plan outlining:

What steps they take to prevent future incidents

 A provider without a documented incident response plan likely does not prioritise security.

5.  Test Access Controls & Authentication: 

Simple tests can reveal security weaknesses:

Try accessing admin-only features without permissions

Check whether password resets are securely handled

Verify that sensitive data is not exposed in public areas

 If the system allows unauthorised access or has weak authentication policies, security is lacking.

6.  Ask About Security Updates & Patch Management: 

When was the last security update applied?

 If updates are rare or undocumented, it suggests the software is not actively maintained.

7. Evaluate API Security (If Applicable): 

Please fill out the form and we’ll be in touch with you.