We build AI systemsthat hold up in production.
Senior cloud and AI engineering. Agentic systems at the front, and the infrastructure that has to hold them up.
A recent project
All our workEnterprise SaaS
A fleet-wide SRE service-maturity scorecard platform
Scores every microservice in a large fleet against an SRE maturity rubric by mining Git, CI and observability data, then serves the results and an advisor through a web dashboard backed by BigQuery history.
Read the case studyWhat we delivered
- Agentic AI
- Custom software engineering
- Developer experience & platform
- Generative AI
- Intelligent automation
We don’t compete on price. We compete on the kind of attention most teams can’t sustain.
We take on work that has to keep running after we leave, and we build it so your team can run it without us.
Simplicity on the far side of complexity.
We work through the complexity instead of around it, so what we hand over is simple to run.
We connect systems that were never meant to work together: a cluster, a data warehouse, a queue, and the spreadsheet somebody emails round every morning. Then we find the part of the process that will not scale, write it down properly, and hand it to machines.
How we work with you
Four steps. You get the first two whether or not you end up hiring us.
- 01One call
We read the system with you
About ninety minutes, no deck, no discovery invoice. We want the shape of the thing: what runs, what it touches, where it hurts, and which constraint is actually load-bearing. Bring an engineer who knows where the bodies are buried.
A shared account of the problem, in your words and ours.
- 02Within a week
You get our assessment in writing
A written assessment of your system as we understand it, including the parts we think you have wrong and the parts we are unsure about. It says what we would do first and what we would refuse to promise. Written so you can forward it to someone who was not on the call.
The document. Yours to keep whether or not you hire us.
- 03If it proceeds
We build it in the open
Observability and evaluation go in from the first commit, not bolted on before handover. You get the repository, the runbooks and the reasoning as they are produced. Nothing is demonstrated that you cannot run yourself, and no step depends on us being in the room.
Working software, and the ability to operate it without us.
- 04At the end
We write the project up
We write the project up: what it does, the dates it ran between, and the capabilities it required. It goes on the site as a case study you can point a colleague at, and you get the same document for internal use.
A case study of the work, written for someone who wasn’t there.
What you hold afterwards
- The written assessment, from the first week.
- The repository, with its history intact.
- Infrastructure as code for everything that runs.
- Runbooks for the failure modes we actually hit.
- The evaluation harness, and what it scores.
- A written handover, so your team can run it.
Problems people call us about
Read the full scenariosSituations we see often, taken from real projects and anonymised. Some name an industry, some name a problem, because a platform problem arrives the same way in every sector.
- E-commerce & Direct-to-ConsumerYou've outgrown a WordPress/WooCommerce store and want a fast headless storefront, but you don't want to build and secure your own checkout, and guest purchases (including ones made before an account exists) still have to unlock the right account, with refunds reversing access.Projects in this area
- Enterprise SaaS & platform teamsAs the fleet grows to hundreds of services across several regions, the platform team becomes the bottleneck: reliability and operational maturity are uneven and invisible, and engineers open tickets for basic questions like 'can this cluster reach that host on that port?'Projects in this area
- Non-profit & educationYour system of record is a SaaS you can't modify, and it only emits a daily spreadsheet that's a 31-day rolling window rather than a running total, so summing snapshots double-counts and naively diffing them reports 'lost' donors who did nothing.Projects in this area
- Fintech & regulatedMoney moves through a third-party processor's webhooks, which retry and arrive out of order, so you risk double-provisioning and failing to reverse on refund, and auditors need every discrepancy visible.Projects in this area
- Media & high-trafficPublic read traffic is spiky and the read path recomputes expensive aggregates or hits a slow upstream on every request; meanwhile large file downloads on poor mobile networks get severed by default request timeouts and full-response buffering, and the public surface must never expose internal fields.Projects in this area
- Teams adopting agentic AI / LLM assistantsYou want to add an LLM assistant to an existing product or ops workflow, grounded in your own data rather than hallucinating, without runaway model cost, without the model taking a destructive action, and without prompt injection riding in through the data it reads.
- Teams whose infrastructure is changed by handYour estate was built through a console and the only record of who changed what is a chat message, so nobody can say with confidence what is running, and no environment can be rebuilt from scratch without the one person who remembers.
- Teams where CI has become the constraintBuilds take long enough that people batch their changes, the pipeline is flaky often enough that a red run gets re-run instead of read, and there is no way to try a change against anything resembling production before it merges.
- Fleets nobody can see intoMetrics, logs and traces live in three different places, the alerts page on causes nobody recognises at three in the morning, and there is no consistent answer to which services are healthy or who owns them.
- Estates moving off on-premises or another cloudYou are carrying a datacentre or a second cloud you no longer want, the workloads on it were never written down, and the migration keeps stalling because nobody can say what will break.
- Estates where every host is slightly differentThe servers were built at different times by different people, the differences between them were never documented, and a change that works on one box fails on the next for reasons nobody can reconstruct afterwards.
- Networks that have outgrown their address planRanges were handed out as they were asked for, two of them now overlap, DNS is edited by hand in a console, and connecting one more environment means an afternoon of working out what is still safe to use.
Technology we work with
Grouped by discipline, because that is usually what you are looking for. Everything named on a project here appears in this list, and so does a good deal that predates them.
Cloud platforms
Estates on all three, and the migrations between them.
- AWS
- Azure
- Google Cloud
Networking
Address plans, DNS, egress and edge. The layer that is invisible until it is wrong and then is the only thing anyone can talk about.
- Akamai
- BIND
- Big-IP
- Cloud Armor
- Cloud DNS
- Cloud NAT
- Cloud VPN
- IPAM
- NGINX
- Shared VPC
- StrongDM
- Twingate
Monitoring and observability
Metrics, logs, traces and the alerting on top of them, built so an on-call engineer is paged by a symptom a user would recognise.
- Cloud Monitoring
- Datadog
- Grafana
- Honeycomb
- Nagios
- OpenTelemetry
- PagerDuty
- Prometheus
- Sumo Logic
CI/CD
Build and release paths, including the ones that had to be replaced while still running.
- Cloud Build
- GitHub Actions
- Jenkins
- Knative
- PHPUnit
- Selenium
- Tekton
GitOps
Cluster and infrastructure state reconciled from version control, so the repository is the system of record rather than a description of it.
- Anthos
- Anthos Config Management
- ArgoCD
- Atlantis
- Kustomize
- Terraform Cloud
Containers and orchestration
Workloads, the clusters under them, and the policy that decides what is allowed to run.
- Anthos Service Mesh
- Cloud Functions
- Cloud Run
- Docker
- GKE
- Helm
- Kubernetes
- Kyverno
- OpenShift
Configuration management and IaC
Provisioning and configuration as code, from bare metal upward. Two generations of it, because estates rarely contain only one.
- Ansible
- Kickstart
- Packer
- Pulumi
- Puppet
- Terraform
- Vagrant
Platform engineering
Service catalogues, golden paths, release automation and the internal tooling engineers reach for because the friction is gone.
- Backstage
- Git
- Moon
- Nx
- Renovate
- Subversion
- release-please
- uv
Data and messaging
Stores, queues and pipelines, including the migrations between them.
- BigQuery
- Bigtable
- Cloud SQL
- Dataflow
- GCS
- Kafka
- Memcached
- MongoDB
- MySQL
- PostgreSQL
- Pub/Sub
- Redis
- SQS
- Spanner
Security and identity
Secrets, certificates and machine identity, kept out of the code and out of the image.
- Cloud KMS
- Okta
- OpenLDAP
- Secret Manager
- Vault
- Workload Identity
- cert-manager
AI and machine learning
Model platforms and agent runtimes, with the evaluation and delivery path around them.
- AutoML
- Claude
- Gemini
- Google ADK
- Vertex AI
Systems and virtualisation
Hypervisors, HPC schedulers, storage and bare-metal provisioning. The estate that predates the cloud and in most places is still running.
- CentOS
- FreeBSD
- Gluster
- IPMI
- KVM
- Linux
- NetApp
- OpenHPC
- OpenStack
- PXE
- Redfish
- Slurm
- Ubuntu
- VMware
- libvirt
- xCAT
Languages
What the work is actually written in.
- Bash
- Go
- Perl
- PowerShell
- Python
- Rust
- TypeScript
Application layer
Runtimes, frameworks and the third-party services the applications sit against.
- Apache
- Apps Script
- Gin
- GraphQL
- Next.js
- Node
- SendGrid
- Shopify
Detailed case studies
All projectsMost projects on our list carry only dates, a sector and a tech stack. These two are written up in full.
- Sep 2025 to Jul 2026Enterprise SaaS
A fleet-wide SRE service-maturity scorecard platform
Scores every microservice in a large fleet against an SRE maturity rubric by mining Git, CI and observability data, then serves the results and an advisor through a web dashboard backed by BigQuery history.
- May 2026 to Jul 2026Enterprise SaaS
A multi-agent SRE assistant platform and its agent-delivery framework
A framework and lifecycle tooling for building, deploying and routing multi-agent assistants for site-reliability work, with a deployed fleet whose flagship investigates, triages and, with human approval, mitigates production incidents.
Our principles
Three principles. We’d rather keep three than list ten.
You can watch it run
Observability and evaluation go in from the start, not just before handover. You never have to take our word for whether something works.
Built to be handed over
When the structure is right, a system is easier to run, change and explain. We build for the team who inherits it, which is usually yours.
Nothing spare
Every part should be earning its place. If it isn’t doing real work, we take it out rather than leave you maintaining it.
- 16 Jul 2026generative AI & model serving
Region-pinning Claude on Vertex AI without fighting your model registry
Claude-on-Vertex serves from only a few regions; rarely the one hosting your agent. Pin conditionally, and return a model object so the registry's regex resolution gets out of the way.
- 09 Jul 2026agentic AI & platform engineering
A Paved Road for LLM Agents: Golden Paths, Resilient Tools, Boring Deploys
Treat agent delivery like any other production system; a scaffold-to-deploy golden path, tool connections that degrade instead of crashing the turn, and secrets tied to per-agent identity.
- 23 Jun 2026networking & security
Fail Closed on Database TLS: The Driver Default Is Cleartext
Most drivers default to no encryption and managed databases rarely force it, so a missing connection-string parameter connects in the clear with no error; refuse to boot without verified TLS, and prove it by reading the negotiated cipher.
Where we do our best work
Whole projects with a clear outcome and an owner on your side.
Problems where the blocker is technical and the decision has already been made.
Teams who want to run and extend what we build after we hand it over.
If that sounds like your situation, we’re probably a good fit.
Got something that has to keep running?
Let’s build it in the open.
One call, about ninety minutes, no slide deck. Within a week you get a written assessment of your system, including the parts we think you’ve got wrong. It’s yours to keep whether or not you hire us.