Ironveil Systems is an Arizona LLC doing architecture, security, monitoring, migrations, and managed hosting — as your ongoing provider or as the team that sets it up and teaches you to run it yourself. Either way you get the configuration, the documentation, and a written account of what each control stops.
01 / WHAT WE DO
We work as an MSP directly, and we take escalations from other MSPs — the infrastructure problem that has outlasted two vendors, the migration nobody wants to own, the outage whose cause is still unexplained. Subcontract or white-label, your client relationship stays yours.
Network segmentation, hypervisor layout, storage and backup design for Proxmox, bare metal, and mixed environments. We write the topology down, including the parts that are compromises, and hand over the diagrams and the runbooks.
Firewall policy, host hardening, patch and release process, key handling, log collection that someone actually reads. Work starts with a written threat model so it is clear which attacks the result addresses and which it does not.
Standing up mail, identity, version control, monitoring, and web hosting on infrastructure you own. Includes the unglamorous half: restore testing, upgrade paths, and an honest estimate of the operating hours it will cost you.
Managed web hosting on our stack or yours, and moves between them: server to server, on-premises to cloud, cloud back to hardware you own. We also move organisations between platforms, such as Google Workspace to Microsoft 365 or the reverse, taking mail, files, calendars and identity across. Migrations run with a rehearsed cutover, a rollback plan, and a maintenance window we commit to in writing.
Day-to-day administration and architecture across Azure, other clouds, Linux and Windows fleets: identity, networking, backup, patching, and cost. We have designed multi-tenant Entra ID estates with delegated business-unit administration — management groups, RBAC, Privileged Identity Management — and documented them so someone else can run them.
We can place dedicated NVIDIA H200 capacity and isolated AI environments in a SOC 2 Type II and ISO 27001 audited Midwest data center. We architect the environment, set the access and network boundaries, and operate it — your data and models stay inside it.
Policy, control mapping, audit preparation, and risk assessment, handled by credentialed GRC practitioners on our team. If compliance work is what you need, say so when you write and we will put you in front of the right person rather than improvising it.
For individuals with real exposure: reducing the personal data already public, separating identity from address and phone, hardening devices and accounts, and building habits that hold. Starts with a written threat model, because privacy work costs convenience and you should know what you are buying.
Applied work on privacy properties of communication systems, plus the tooling that comes out of client engagements. Results are published when they hold up, and withdrawn when they do not.
MANAGED HOSTING · PRICING
$15–30per month
Hosting, TLS, CDN and uptime monitoring.
from $40per month
A dedicated hardened VM, filtered outbound traffic, encrypted off-site backups, and updates tested on a copy first.
$15–200per month
Depends on the stack, from a single service to databases and multiple components.
Two recent engagements. Client names are withheld; the figures come from the engagement records.
SOFTWARE HOLDING COMPANY · MULTIPLE BUSINESS UNITS
The data center hosting a shared Hyper-V environment was closing. Its servers ran order entry, license-key services, development environments, web hosting and file storage for several business units, some of them customer-facing with thousands of users.
WHAT WE DID
NONPROFIT · SCHOOL-BASED COUNSELING · ~110 STAFF
The organization had no security groups, no consistent address format, no device policy, and admin rights on everyday mailboxes. Staff handle student and clinical data, mostly on personal phones. Google Workspace had to stay in service for file sharing with partner school systems.
WHAT WE DID
Software companies and operators we have done infrastructure, security, or platform work for.
02 / AI COMPUTE
We rent NVIDIA H200 nodes in a SOC 2 Type II and ISO 27001 audited Midwest data center. We set the access and network boundaries and operate the environment. Your data and models stay inside it.
Whole dedicated H200 nodes, or a share of one for smaller workloads.
Hourly, monthly, or on contract.
Environment architecture, access control, network boundaries, and day-to-day operation, documented the same way as everything else we hand over.
03 / OPEN SOURCE
A provisioning system that builds hardened WordPress hosts on Proxmox VE. You give it a host and a site list; it produces segmented VMs or containers, a default-deny firewall policy, signed releases, and backups it verifies by restoring them.
Written for MSPs and small teams who run client sites and would rather not rebuild the same stack by hand every time. It is opinionated about layout and process, which is the point: the same shape every time is what makes an incident tractable at 2am.
MIT licensed. No hosted control plane, no telemetry, no account. Read the code before you run it.
You can also have us run it. Our managed hosting is WASP on our hardware: we handle provisioning, patching, signing keys, and the restore tests, and you get the same segmentation and firewall policy as a self-hosted install. Because the stack is the open one, leaving means taking the configuration with you rather than starting over.
WHAT IT GUARANTEES
WHERE IT STOPS
ARCHITECTURE, ANIMATED
Five diagrams of how a WASP host is laid out and how traffic, releases and imported sites move through it.
04 / RESEARCH & DEVELOPMENT
We keep a research line running alongside client work. Both programs below are under investigation rather than for sale, and both are described here at the stage they are actually at.
Neither has been through third-party review. Where we have measurements, they come from our own lab under conditions we chose, which is a weaker claim than it sounds and we would rather say so than imply otherwise.
PROGRAM 01
Security operations tooling that rebuilds its own compromised hosts. Working lab build.
PROGRAM 02
Privacy-preserving communications
How much metadata leakage a usable messaging system can shed. Simulation only.
05 / HOW WE WORK
01
Hosted services are a fine choice when you make it deliberately. We start from infrastructure you own, then add outside dependencies one at a time, each with a reason and an exit.
02
Every control we ship comes with the attack it stops and the attack it does not. A control whose boundary nobody wrote down gets trusted past its design, which is how people get surprised.
03
Configuration lives in files you can read and diff. No black-box agents, no vendor console holding the only copy of the truth. If we leave, everything needed to keep running stays with you.
Larger engagements run in phases — envisioning, planning, developing, deploying and stabilizing — adapted from the Microsoft Solutions Framework. Each phase ends with a written artifact: a scope, a design document, a risk assessment, a pilot and acceptance plan, and a handover to whoever operates the system next.
06 / CONTACT
Describe the environment and the problem. We will reply with what we would look at first and whether we are the right people for it.
Ironveil Systems LLC · Arizona, United States
SIMPLEX
End-to-end encrypted chat with no phone number, account, or user ID. Use this if you would rather not put the details in email.
WHAT TO INCLUDE