How Climatiq's lean security team built custom automation on top of Iru

The challenge

Climatiq is a carbon emissions data and API platform. It calculates the CO2-equivalent output of other companies' operations (shipping routes, manufacturing inputs, energy use) so they report on their sustainability goals, back sustainability claims with real numbers, or optimize their supply chain and manufacturing processes. It's a fast-growing team, currently around 47 people, based mostly in Berlin, hiring continuously. Lorenzo Romero, Climatiq's security engineer, covers a wide scope for one person: cloud infrastructure, development environments, and the company's fleet of Mac laptops. As a European company, Climatiq holds itself to ISO 27001 and GDPR. Keeping the device fleet itself compliant sits largely with Lorenzo.

When Lorenzo joined, the fleet had been on Iru (then Kandji) for roughly a year, but running mostly on manual setup. Laptops were enrolled by hand rather than automatically, and a requirement to enforce web filtering across the fleet hadn't yet been addressed.

The solution

Lorenzo's first jobs in Iru were the obvious ones: get devices enrolling automatically instead of by hand, and finally enforce web filtering across the fleet. Closing those two gaps set the tone for everything he built afterward.

Across every project Lorenzo has taken on, the same thing keeps showing up: Iru stays simple for the people who don't need to think about it, while still giving him room to build something custom when he wants to. For example, the concept of a library with Library Items makes sense to most people right away. Lorenzo says he's never had someone come to him because they didn't understand how to use it.

Enforcing web filtering as a hard rule

Lorenzo closed a compliance gap the fleet had been carrying: enforced web filtering. Using a custom profile (a way to enforce bespoke OS-level settings), he forced every Mac onto a malware-blocking DNS server, so browsers simply fail to resolve known-malicious domains, no exceptions and nothing for the end user to configure or forget. Chrome Enterprise configuration through Iru, tied into Climatiq's existing Google Workspace setup, went out at the same time.

From manual setup to zero-touch, with the basics baked in

Climatiq's Mac reseller could tie new hardware directly to the company's Apple Business ID, and Lorenzo configured Iru's auto-enroll to take it from there. The basics that already existed (screen-lock timing, a lock-screen keyboard shortcut, a password manager pushed to every machine) now apply automatically the moment a laptop connects to the internet, with no manual setup step for Lorenzo or the new hire.

Auditing the fleet with Iru's API and Notion

The most distinctive piece of Climatiq's setup is an app audit helper Lorenzo built himself. Climatiq keeps a Notion database of every app it's approved for use, and a custom script pulls a full inventory of installed apps across the fleet from Iru's API, cross-references it against the Notion list, and surfaces exactly what's installed but not approved.

He no longer needs to manually check what apps are running on his endpoints. Prefix-based rules (anything with an Apple or Adobe bundle ID, for instance) auto-clear most of the noise, so the list Lorenzo reviews a couple of times a year stays manageable.

For the handful of apps Climatiq has decided are outright not appropriate, Iru's block list stops them from launching at all, a step the team uses deliberately and sparingly.

Zero-config networking for new hires

Climatiq also uses Iru to roll out Tailscale with the company's identity pre-configured, so a new laptop opens straight to Climatiq's Google Workspace login the first time it connects, with no manual network setup for Lorenzo or the new hire to get through before they can start working.

Results

A small team manages endpoint compliance and security for a company with team members spread across Europe, and with Iru, things stay simple enough that no person becomes a single point of failure.

That same simplicity extends to how Iru handles the unexpected. When a zero-click, zero-day vulnerability in Adobe software surfaced, within about two hours the vulnerability was being tracked by Iru and auto-patched across the fleet as a critical fix.

Lorenzo thinks about the value of a tool in terms of overhead. Every tool is a spend, and for some products that spend includes the people needed just to keep it running. A single person at a small or medium business can handle Iru without getting overwhelmed by complexity, even though the platform supports real depth when you need it: custom profiles configured in detail, and full API access, like the Notion integration Climatiq built for its app audit.

Looking ahead

For a small security team, sometimes the biggest compliment a piece of software can get is silence: no fires to put out, no backlog quietly building up behind it. That's where Climatiq's device management sits today.