Cloud, Data & Platform

Zero-trust multi-account landing zone that passed SOC 2 first time

A monolithic cloud estate with shared credentials and flat networking had an audit date. We rebuilt it as modular, policy-bounded accounts with every change in code.

Client: Regulated financial services provider
Industry: Financial services
Disclosure: Anonymised under NDA

Type II passed with zero findings on first evaluation: SOC 2Type II passed with zero findings on first evaluation
Infrastructure provisioned from code: 100%Infrastructure provisioned from code
Public IP exposures left: 0Public IP exposures left

The challenge

Shared credentials, no network micro-segmentation and a SOC 2 Type II audit on the calendar.

Stack

AWS Control Tower
Terraform
Transit Gateway
Zero-trust access

What we did

01Modular Terraform landing zones on AWS Control Tower
02Service control policy boundaries for every account
03Hub-and-spoke transit networking with segmented accounts
04Zero-trust access in place of public endpoints

Generic reference architectureControl to evidence

A generic representation of the pattern, not the client’s topology.

How you would buy this

Fixed-scope Delivery Sprint

One outcome, one price: a cloud-cost cut, a platform migration, a ClickHouse or IIoT ingestion path, or a production AI-agent pilot.

Compare all engagements →

Fixed fee · 2–6 weeks

Fixed-scope Delivery Sprint

From

$25,000

fixed fee

One outcome, one price: a cloud-cost cut, a platform migration, a ClickHouse or IIoT ingestion path, or a production AI-agent pilot.

Written acceptance criteria per milestone
Demo at every milestone
Source, runbooks and handover included
Milestone billing 30 / 40 / 30

Ask about this engagement

More cloud, data & platform work

Cloud, Data & PlatformNDA · AI & analytics SaaS

85% infrastructure cost cut with a hybrid bare-metal platform

High-growth AI and analytics SaaS

Managed databases, vector search and LLM API tokens had grown into a six-figure monthly bill. We moved the heavy paths onto owned infrastructure without giving up the cloud where it earns its keep.

Lower recurring infrastructure spend: 85%Lower recurring infrastructure spend
Query latency, down from 350 ms: <45 msQuery latency, down from 350 ms
Unencrypted network paths: 0Unencrypted network paths

Cloud, Data & PlatformNDA · Logistics

From kickoff to paying customers in 14 weeks

Series A logistics SaaS

A greenfield dispatch platform. We owned the architecture, the infrastructure and the first three service surfaces, then hired the team that took it over.

Kickoff to first paying customer: 14 wksKickoff to first paying customer
Uptime from day one: 99.95%Uptime from day one
Engineers hired and onboarded: 3 → 11Engineers hired and onboarded

Cloud, Data & PlatformNDA · Healthcare

SOC 2 Type II and HIPAA readiness in one quarter

Pre-Series-A healthtech

A hospital pilot depended on SOC 2 and HIPAA controls the team did not have. We rewrote the infrastructure as code and built the evidence trail an auditor needs.

To SOC 2 Type II report: 90 daysTo SOC 2 Type II report
Critical findings on first audit: 0Critical findings on first audit
Hospital pilot closed: 1Hospital pilot closed

Start with a scoping call.

Thirty minutes with the founder. Bring your architecture diagram, your cloud bill or your plant drawings, and leave with what is realistic — including when the answer is that you do not need us yet.

Book a scoping call See engagements and pricing

Mutual NDA before any detail is shared. First response within 24 hours.