# Case Studies — Anonymized Engagements | RedactLabs

> Source: https://redactlabs.ca/case-studies/
> Machine-readable Markdown of this page (also served at this URL under `Accept: text/markdown`).

# The operational record.

Anonymized engagements, with the before/after metrics each one moved. Each study documents the problem we walked into, the operational constraint that shaped the approach, and the outcomes. Client names withheld by request; we don't publish case studies our clients haven't reviewed.

- Executive transportation, Toronto · Website rebuild + managed hosting · Summer 2026 launch; September 2026 rebuild · Executive transport: a hardened launch, then a tested Astro rebuild · A Toronto executive-transportation company launched on our hardened edge in the summer of 2026 as nine hand-edited HTML pages, and its untested booking path broke silently for about three weeks. After the fix, the booking funnel got end-to-end tests. In September we rebuilt the site in Astro, deployed from CI, with staged releases and automatic rollback, and cut its JavaScript from 980 KiB to 216 KiB. · Front-end · Nine hand-edited HTML pages, copied into place on each deploy → Astro build, deployed from CI
- Booking funnel · Untested; it broke silently for about three weeks → Tested end to end; a failing test blocks the deploy
- Major Ontario venue · Zero-trust network redesign · 12 weeks (8 design, 4 live) · Major venue: a zero-trust redesign of a flat, always-on network · A major Ontario venue ran public Wi-Fi, ticketing, operational systems, and back-office on a single flat network — every tier could reach every other. We redesigned it to a zero-trust, VLAN-per-tier architecture with identity-first, time-boxed access, so the systems the public can touch can never reach the systems that run the building. · Network segmentation · Flat L2 across all tiers → VLAN per tier (corporate, broadcast, crew, public)
- Operational-system exposure · Reachable from public Wi-Fi → Isolated VRF, no public-tier reachability
- National registered charity · Posture audit + remediation · 6 weeks · Registered charity, exposed surface to A+ headers in 6 weeks · A donor-data-handling Canadian charity engaged us after a board-level concern about a competitor's recent breach. Six weeks later: A+ header posture, MFA across the entire staff, donor PII encrypted in transit and at rest, board-ready PIPEDA documentation in their hands. · Header posture · F (no CSP, no HSTS) → A+ (strict CSP, HSTS preload)
- MFA coverage across staff · 18% → 100%

## Want a private reference?

Most of our clients are comfortable being a private reference but not a public case study. Talk to us for an introduction.

## Want one of these for your work?

Every engagement starts with a 30-minute posture call. Free, no commitment.