G.R.A.M.S Styling has been an Aiteklabs client for several years. Long before the move to a new platform, we looked after their WooCommerce shop: updates, server hardening, Cloudflare in front of the site, bot protection on the forms, a mail guard so order emails reached customers, and the occasional incident at two in the morning. That is how we learned what a small brand with a global customer base actually needs from its shop, and why we offered them a way out of the plugin stack.
The new platform is not only faster and cheaper to run. It gives a small business the kind of security and operations discipline that is usually reserved for companies with an IT department, built in from the first deploy.
Security on the edge, before a request reaches the shop
- Every public form is protected by Cloudflare Turnstile: login, sign-up, password reset, contact, the photo-sharing page. The check fails closed in production, so a missing or forged token is refused.
- Until launch, the storefront and the admin sit behind Cloudflare Access. Only named people, and the storefront's own service identity, can reach the API.
- A web application firewall blocks image scraping and hotlinking, and rate limits the search endpoint, without touching real customers.
- TLS 1.2 minimum, HSTS, a Content Security Policy rolled out in report-only mode first, then enforced, plus the usual hardening headers.
- Webhooks from the payment providers are verified cryptographically before an order changes state.
Security inside the stack
- Customer passwords were never exported in clear text. The old WordPress hashes are verified at first login and silently upgraded to a modern algorithm.
- Secrets are generated by the platform, never typed into a chat or a ticket, and rotated when a mistake happens.
- The admin is invitation only, and the workshops get their own limited logins for the production board instead of a shared store password.
- Every change goes through a pull request, a type check and a container build that is scanned for known vulnerabilities before it can be deployed. An image with a fixable critical issue does not ship.
- Before go-live, the code was reviewed for security by our team, a security specialist and three frontier AI models, and every finding was either fixed or rejected with a written reason.
Operations: the boring parts that save the business
- Backups every hour, kept on the server for two days and off-site for a month, with a restore that has been tested end to end, not assumed.
- Monitoring: an uptime check on the API, self-hosted error tracking for the backend and the workshop board, and alerts to the owner's phone for failed deploys, failed backups and errors in production.
- Deploys pull a prebuilt image, so a release takes about a minute and a rollback is one click.
- Housekeeping is automated: old images are pruned, disk and inode usage is watched, dependencies are updated on a schedule.
- Nothing depends on one person's laptop. The infrastructure is described in files in the repository, and the runbook for a restore is written down.
Why this matters for a small brand
A platform like Shopify sells this peace of mind as part of its subscription, and takes a percentage of every sale to pay for it. Our approach gives a small business the same quality on open-source software it owns, on infrastructure that costs a fraction of a platform subscription, with the latest tools: Cloudflare Workers at the edge, Medusa as the commerce engine, containers built and scanned by CI, and monitoring that tells us before the customer does. Monitoring and support come as Aiteklabs packages sized to the complexity of the shop, so the business pays for the level of care it needs, not for a percentage of what it sells.
That is the service: not a one-off build, but a shop that stays secure, backed up and up to date for years, at a cost that makes sense for the size of the business.