Azure for logistics and foreign trade: your clients' information, treated as theirs.

Arcetec is a Microsoft Partner that implements Microsoft Azure for logistics operators, customs brokers, carriers and terminals in Colombia. The information a logistics operation handles doesn't entirely belong to it: it knows what each client imports, in what volume, at what price and by which route, and in the wrong hands that information doesn't lead to a fine but to a lost account. On top of that, the operation never closes, so there is no convenient maintenance window, and an outage is measured in stopped trucks and containers that aren't released. On Azure, that information is protected in layers: identity and multi-factor authentication with Microsoft Entra ID, least-privilege access by role, private networks with no internet exposure, encryption in transit and at rest with keys in Key Vault, continuous threat detection, access traceability, and backup with retention to restore to an earlier point in time. The infrastructure comes certified under ISO 27001 and SOC, and availability is sustained through redundancy rather than a single on-site server. Arcetec has already migrated to Azure the infrastructure of a logistics company that ran on its own servers, using a hybrid environment so operations weren't interrupted during the transition. We provide the assessment, the landing zone, wave-based migration, integration with operational systems and ongoing support from Cajicá, Cundinamarca.

You know what each client imports, in what volume and at what price. That, in the wrong hands, isn't a fine: it's a lost account. And your operation never closes, so there's no maintenance window either.

Wave-based migration with a hybrid environment: operations don't stop.
Real redundancy, not a single on-site server.
Traceability of who looked up which rate, and for which client.

Inventario de la información que maneja una organización del Logistics operation, clasificada entre datos sensibles, datos personales e información de negocio, y con el control que protege a cada categoría. No contiene ningún dato real ni simulado.

Three reasons that matter in an operation that never closes.

They're not the ones from a cloud brochure: they're the three that become urgent when cargo can't wait and the client asks where their container is.

There's no maintenance window — A port or a distribution center doesn't close on Sundays. That's why migration happens in waves with a hybrid environment: operations continue while things move, and each wave can be rolled back.
Redundancy instead of a single server — When everything depends on one machine at your site, a power failure means a stopped operation. Availability stops being a promise from your internet provider and becomes an architecture decision.
The information isn't yours — You handle your clients' commercial data: what they move, how much and at what cost. Least-privilege access and traceability aren't bureaucracy; they're what let you answer when someone asks who saw what.

What happens the day it fails

The question isn't whether the information is important. It's what exactly happens when it leaks, gets lost or becomes inaccessible at three in the morning.

If the system becomes inaccessible, containers aren't released, documents aren't issued and trucks wait. The cost isn't measured in hours of downtime but in delays, storage charges and calls from clients. If commercial information leaks, the damage is different from a fine: a competitor learns what your client moves and at what rate. That client doesn't file a complaint; they leave — and don't always tell you why. If it gets encrypted in an attack, the only real way out is the backup, and not the one that exists but the one someone has tested by restoring it. In an operation that bills per movement, every day without the system is revenue that doesn't come back.

Inaccessible: stopped trucks, storage charges and delays that get billed
Leaked: the client doesn't complain, they leave with their account
Encrypted in an attack: only a tested backup brings it back
No traceability: you can't prove who looked up what

A backup that was never restored is an assumption — In the assessment we don't check whether you have a backup, but whether it works: how long it takes to come back, to what point in time, and who has tested it.

Layers that hold each other up

No layer is infallible. The right question isn't which one is best, but what's left standing when one gives way.

Las capas de defensa de una implementación en Azure —identidad, acceso mínimo, red privada, cifrado del dato, detección continua y respaldo— cada una con lo que sostiene cuando la anterior cede.

Most real incidents don't start with a sophisticated attack: they start with a credential shared between shifts, a permission no one revoked when someone left the company, or a server with remote access left open so people can get in on weekends. Against that, a single control doesn't help; order does. Multi-factor authentication stops the stolen credential; if they still get in, least-privilege access limits which clients that account can reach; the private network removes the door from the outside; encryption makes whatever is copied unreadable; traceability lets you know what happened; and the backup brings back what was lost. None of those layers is turned on by default in a new subscription. Configuring them is the work.

From assessment to a monitored operation.

The platform comes with the controls. Turning them on in the right order, connecting them to operational systems and sustaining them is the work.

Security and continuity assessment — What's exposed today, who has access to which clients' information, whether the backup works and what happens if your site loses power. It ends in a document with scope and cost, yours to keep even if you work with someone else.
From your server to Azure — Inventory, sizing and wave-based migration with a hybrid environment, which is what makes it possible to move an operation without stopping it. Each wave has its rollback tested before it runs.
Entra ID and per-account access — Multi-factor authentication and least-privilege access by role, so whoever serves one client doesn't see another's rates. With the same corporate accounts you already manage.
Connection to operational systems — What lives today in your management system, spreadsheets and email is connected through controlled interfaces, with a record of what came in and what went out. Without exposing anything to the internet.
Operations analytics — Metrics on lead times, occupancy, cost per movement and profitability by account with Microsoft Fabric and Power BI, on consolidated data instead of the file someone exported on Tuesday.
Managed support — Monitoring, alerts and incident response with response times committed in writing. In Spanish and in your same time zone, which stops being a detail in an operation that runs at night.

What the platform brings

None of these is our result: they're controls Azure has already audited and that your operation inherits.

AES-256 — Encryption at rest, with TLS in transit, on by default
ISO — Infrastructure certified under ISO 27001, SOC and other frameworks
24/7 — Continuous threat detection, not an annual audit
Point-in-time — Restore to an earlier point in time, with retention

Third-party information, with everything that implies.

Most of what you safeguard isn't yours: it's your clients' commercial operations. And driver and carrier data are personal data under Colombia's Law 1581 of 2012. Everything else is designed around those two sentences.

End-to-end encryption — In transit and at rest, with keys managed in Key Vault. You can manage your own keys if your policy or a client's requires it, and a copied disk can't be read.
Least-privilege access by account — Whoever serves one client doesn't need to see another's rates, and with least-privilege access they don't. Temporary elevations expire on their own instead of piling up shift after shift.
Query traceability — There's a record of who looked up or downloaded what and when. It's what lets you answer a client who asks who saw their information, instead of guessing.
No open door to the outside — Operational systems are reached over a private network, not through a remote desktop left open so people can get in on weekends. That last one is how half of real incidents begin.
Data residency, stated plainly — Azure has no region in Colombia. Data stays in the region you choose—Brazil, with Chile and Mexico opening—and that decision is documented before anything is moved, not after signing.
Continuity, not just security — Redundancy and restore to an earlier point in time. In an operation that bills per movement, availability is part of security, not a separate conversation.

What gets deployed, exactly

The reference architecture we start with, which the assessment adjusts to your case.

Everything runs in your subscription, not on a platform of ours. It's a difference that matters the day you decide to run it with your own team, or to switch providers. Operational systems run on machines or services with redundancy, not on a single machine. Around them: what you receive from your counterparties, identity and keys, analytics on consolidated data, and the observability that warns you before a client calls. Traffic doesn't go out to the public internet: it's handled over a private network, which is the first thing checked when a large client audits you.

Runs in your subscription, with your billing and your keys
Redundancy instead of a single on-site server
Private network: no remote desktop open to the internet
Analytics on consolidated data, not on scattered exports

Arquitectura de referencia de una Landing zone de Azure para una institución de salud: la capa que recibe lo que envía el sistema asistencial, el servicio administrado donde vive el dato clínico, la identidad y las llaves, la analítica de gestión y la observabilidad.

Who's responsible for what

In the cloud, compliance is shared, and almost no one says so clearly before signing.

Reparto del cumplimiento normativo entre lo que Azure ya trae certificado, lo que se configura durante el proyecto y lo que sigue siendo responsabilidad de la institución de salud, como la autorización del titular para tratar sus datos.

There are three different owners of the same obligation, and confusing them is what causes surprises when a large client audits you. Azure comes certified for what's its own: the audited infrastructure and encryption. The project configures what depends on your case: roles by account, traceability, redundancy and the tested backup. And some things remain yours no matter what. The confidentiality agreements with your clients and the internal policy on who can see what are yours: no provider takes them on. We'd rather say it on this page than have it come up at the closing meeting.

Questions we get asked before signing.

The ones about security, continuity and experience, answered without embellishment.

Can we migrate without stopping operations?

Yes, and it's the constraint we design around from the start. Migration happens in waves with a hybrid environment during the transition: part of the operation stays where it is while the other part already runs in the cloud, and we move forward once each wave is verified. Each one has a rollback plan tested before it runs, not written just in case. In an operation that never closes, this isn't a methodological preference but the condition for being able to start.

Have you done this before in logistics?

Yes. We migrated to Microsoft Azure the entire infrastructure of a logistics company that ran on its own servers and was limited in its ability to grow, modernizing its critical applications and using a hybrid environment to ensure continuity during the transition. The recorded results were a sixty percent reduction in infrastructure costs, ninety-nine point nine percent availability and three times the processing capacity. The client is under a confidentiality agreement and we don't name them on our website, but in a meeting we can give you the context and the people who carried it out.

Is Azure more secure than our own server?

Not automatically, and anyone who says yes without asking anything else is selling to you. A well-managed, up-to-date server of your own, with a tested backup and controlled access, can be perfectly secure. What almost no logistics operator can sustain on its own is continuous monitoring, constant patching, redundancy and third-party audits, because that requires a dedicated team. With Azure, that part is already paid for and audited. Poorly configured, Azure is as insecure as anything else.

What happens if we're hit by ransomware?

The only defense that really works against an attacker encrypting your files is the backup, and someone having tested it by restoring it. That's why backup with retention and point-in-time restore are part of the base scope, not an extra. The other layers exist so the attack doesn't get through; the backup exists for the day one of them fails. In an operation that bills per movement, every day without the system is revenue you don't recover, so in the assessment we measure how long your current backup takes to get you back into production.

Does it integrate with the management system we already use?

That's exactly the question the assessment answers. Integration is done against whatever interface your system exposes, and the effort depends on how structured its output is today. Modern systems usually expose ready-made services; older ones require an intermediate layer that extracts and normalizes the data. Both cases are viable and we've done both; what changes is the effort, which is why we don't quote without an assessment.

Do you have experience with foreign trade data?

Yes, in a project worth telling in full. We built a process to extract and clean customs data from seven Latin American countries so a multinational consumer goods company could understand the import and export behavior of its products in the region. The biggest challenge was the free-text fields: customs descriptions are written by people, with abbreviations and typos. One important point for this page: that project was originally deployed on another cloud, and the infrastructure fell short for the volume. We say so because it's the reason we now size workloads before choosing a platform, and because leaving it out would suggest it ran on Azure.

How much does Azure cost and how is it billed?

Azure is billed by consumption: you pay for the resources you turn on and for the time they're on, with no upfront license. Our implementation is quoted as a fixed project, with fixed scope and price defined after the assessment. During the assessment we deliver a monthly consumption estimate with the numbers for your case and set up cost control and alerts from day one. The surprise bill in the second month is the most common problem in a poorly governed migration, and it's avoidable.

We know the industry, not just the cloud.

Arcetec has a consulting line in customs, ports and logistics in addition to its technology line. That means the conversation doesn't start with explaining to us what a manifest is.

We speak your language — We're not just a cloud integrator. We also work in customs and port operations, so we understand what breaks when the system goes down in the middle of a clearance.
Microsoft partner — The profile can be checked in the official directory. And when a certification belongs to the platform and not to us, we say so.
Nothing stays on our side — Everything is deployed in your cloud. The day you want to run it yourself or switch providers, there's nothing to recover from us.
Quoted after we understand — First the assessment, then the proposal with fixed scope and price. Whoever quotes a migration over the phone ends up charging the difference later.
Support in Spanish, Colombia time — A team in Cundinamarca that responds in your same time zone, with response times committed in writing.
No dependence on us — The deployment is written down and versioned, not kept in a consultant's head. That's what allows your team to understand and maintain it.

This is also part of the same picture.

The other pages in this line, so you can continue wherever makes sense.

Azure Migration — Design, migration, and operations on Azure, with consumption billed in pesos.
Cloud servers — Managed virtual machines and dedicated servers on Azure.
Azure for healthcare — Learn how Microsoft Azure protects sensitive healthcare data in Colombia, ensuring security and regulatory compliance.
Azure for logistics and foreign trade — Azure for logistics operators, customs brokers and transportation.
Microsoft Licensing — Microsoft 365, Copilot and Azure through CSP, invoiced in pesos.

What happens if your site is left without its systems tomorrow?

A two-to-four-week assessment tells you what's exposed, how long your backup takes to get you back into production and how much it costs to close the gap. The document is yours even if you decide to work with someone else.

Schedule your security assessment

Tell us where your operation runs today and what concerns you. We'll get back to you in less than one business day.

Two ways to work with us

We work in two ways, and this is one of them. Azure projects are deployed in the client's subscription, with their billing and their keys: the infrastructure is theirs, and we design it, migrate it and sustain it. Our own products— CataAI, Cowork Arcetec with Microsoft 365 and Lienzo de Arcetec —work the other way around: they're a service Arcetec operates on its own cloud, with a dedicated instance per client. There's nothing to manage.

Artículos sobre Microsoft Azure

Topic:Microsoft Azure