§00/CAPABILITIES
Four domains. One discipline.
We work across the full stack of engineering sovereignty — from bare-metal Kubernetes to governed AI inference — with the same underlying method: design in the control, make the evidence a byproduct of operations, and ensure your team owns what we build.
HOW THE FOUR FIT TOGETHER
Sovereignty is a system, not a feature
Each domain reinforces the others. Infrastructure ownership creates the substrate on which self-hosted OSS tools run — and on which inference stays inside your perimeter. Audit-grade engineering provides the evidence layer that makes self-hosting safe in regulated environments. Open-source strategy removes the SaaS dependencies that create vendor leverage. Sovereign AI adds the capability to use intelligence on your data without exporting it.
You do not have to engage all four. Many clients start with the domain where their exposure is highest — typically infrastructure if they are facing hyperscaler lock-in, or audit if they are approaching a compliance certification. The four are designed to compose, not to require each other.
Infrastructure & Platform
OWN-THE-SUBSTRATE
Open-Source & Tooling Strategy
END-SAAS-RANSOM
Sovereign AI
INFERENCE-INSIDE-PERIMETER
Audit & Compliance Engineering
EVIDENCE-BY-DEFAULT
§01/OWN-THE-SUBSTRATE
Infrastructure & Platform
Production-grade Kubernetes on infrastructure you control — from bare metal to private cloud.
We design and deliver self-operated Kubernetes clusters on Talos Linux: immutable, minimal, API-only. GitOps with Argo CD or Flux makes every cluster state auditable and reproducible from a single git ref. Infrastructure is expressed as code (OpenTofu/Terraform), environment bootstrap is automated end-to-end, and on-call handoff is a first-class deliverable — not an afterthought. When you walk away, your team operates it without us.
40–65%
Infra cost reduction (representative range)
vs. comparable managed-cloud footprint after 24 months of stable operation
Deliverables
Architecture Decision Records (ADRs)
Numbered, dated records of every infrastructure choice with the alternatives considered and the rationale — permanent institutional memory.
Cluster bootstrap automation
Fully declarative provisioning pipeline: from bare node to production-ready cluster in a single command, documented and tested.
GitOps state repository
Structured Flux/Argo CD config repo with environment promotion gates, encrypted secrets via Sealed Secrets or External Secrets Operator, and PR-gated changes.
TCO model (5-year)
Spreadsheet and narrative comparing substrate cost, staffing delta, and egress savings against the managed-service baseline you are replacing or avoiding.
On-call runbooks & incident playbooks
Validated against real failure scenarios in staging — not copied from vendor docs. Covers node failure, etcd quorum loss, storage degradation, and network partition.
Observability stack & dashboards
Prometheus + Grafana + Loki + Tempo wired to OpenTelemetry; curated dashboards for infra health, SLI/SLO tracking, and cost attribution per namespace.
Stack
Trade-off
Capability ownership vs. managed convenience
A managed Kubernetes service (EKS, GKE, AKS) removes the control-plane burden in exchange for API surface lock-in, opaque pricing tied to the provider's data gravity, and audit evidence that arrives pre-filtered. Owning the substrate means your team carries operational responsibility — but it also means every configuration decision is explicit, every cost is visible, and every compliance artefact is yours to produce and own. For teams with a 3-5 year time horizon and a regulated workload, this trade is usually favorable. For teams still validating product-market fit, it may not be.
§02/END-SAAS-RANSOM
Open-Source & Tooling Strategy
Audit your SaaS concentration, then replace it on a timeline that matches your renewals.
SaaS sprawl is a latent tax: per-seat pricing that compounds, data that lives outside your perimeter, and renewal negotiations where the vendor holds leverage because migration cost is unknown. We start with a vendor footprint audit — every tool, its contract term, its data residency, and the cost of extracting your data today. From that map we identify the highest-leverage replacements, sequence them against renewal windows, and deliver migrations with zero-downtime cutover plans and validated rollback paths. OSS is not a cost-saving exercise — it is a discipline of understanding what you depend on.
3–7×
SaaS cost reduction (representative range)
for teams replacing four or more commercial tools with OSS equivalents within 12 months
Deliverables
Vendor footprint audit
Structured inventory: tool, purpose, contract term, per-seat cost, data residency status, and effort-to-migrate estimate.
Phased migration roadmap
Sequenced against your real renewal calendar. Each phase: target tool, migration path, rollback plan, and team readiness requirements.
CI/CD platform migration
From hosted CI (GitHub Actions, CircleCI) to self-hosted Forgejo/Gitea + Woodpecker or Drone — with pipeline parity validation and secret migration.
Identity & SSO migration
From Okta/Auth0 to Keycloak or Authentik — SAML/OIDC provider parity, user migration script, and parallel-run period to validate before cutover.
Secrets management implementation
HashiCorp Vault or OpenBao deployment: HA cluster, PKI engine, dynamic credentials for databases, Kubernetes auth method wired to workload identity.
License & compliance documentation
For each OSS component: license type, obligations, contribution policy, and long-term maintainability assessment (committer activity, security track record).
Stack
Trade-off
Operational responsibility vs. vendor SLAs
Self-hosted OSS tools require your team (or ours, during an engagement) to manage upgrades, patches, backup, and incident response. That SLA is now yours to own, not a number in a vendor contract you can point at. The offset is that you control the upgrade schedule, you know exactly what version is running, and you have the source code when something breaks unexpectedly. For security-sensitive tooling — identity, secrets management, CI/CD — owning the upgrade schedule is often a net security gain: you patch on your timeline, not the vendor's quarterly release.
§03/INFERENCE-INSIDE-PERIMETER
Sovereign AI
Local inference on owned GPUs. Private RAG. Governed agents. Your data stays in your perimeter.
When a regulated organisation routes data through a third-party inference API, it exports sensitive context to infrastructure it does not control — with terms-of-service that can change, with audit trails it cannot inspect, and with model versions it cannot pin. We deploy inference stacks on your hardware: vLLM, Ollama, or TGI configured for the model classes your workload requires, with GPU allocation governed by Kubernetes device plugins. Private RAG pipelines use pgvector, Qdrant, or Weaviate to keep embedding data inside your perimeter. Agent frameworks run under governance controls — prompt logging, output evaluation, and rollback capability are designed in from the start.
Field notes
100%
Prompt data in-perimeter
no inference traffic leaves the cluster — verified by network policy and egress audit
Deliverables
Inference stack deployment
vLLM or Ollama on Kubernetes with GPU device plugin scheduling, model versioning, and automated health checks — serving both chat and embedding endpoints.
Private RAG pipeline
Document ingestion, chunking, embedding, and retrieval using pgvector or Qdrant — with latency profiling, accuracy eval, and index maintenance automation.
Model governance framework
Policy document + tooling: model registry, version pins, evaluation harness (evals per task), change control process, and incident classification for model-related failures.
Agent architecture design
Scoped, governed multi-agent frameworks: tool call logging, prompt/response retention for audit, guardrails for PII and sensitive output, and retry/fallback logic.
Data residency documentation
Mapping of every data path through the AI stack — ingestion, embedding, inference, storage — with residency classification for regulatory review.
GPU TCO & capability model
Honest comparison: owned GPU cluster vs. per-token API spend across your projected workload, including staffing, power, and model update cost.
Stack
Trade-off
Model ceiling vs. data control — and the real cost of GPU ownership
Self-hosted inference caps your accessible models at what you can run on hardware you own or lease. Frontier models (GPT-4-class, Gemini Ultra) are only accessible through their providers' APIs, and that is a real capability ceiling for some use cases. The economics of GPU ownership are also genuinely complex: H100 cluster costs, power, cooling, and the staffing to manage them add up. The trade is not always obvious. What is clear: for regulated use cases where patient data, financial records, or proprietary code enters the prompt, API-based inference is an unacceptable risk posture — the operational cost of sovereignty is lower than the liability exposure. For workloads where data sensitivity is low, managed APIs may be the right answer. We will tell you which is which.
§04/EVIDENCE-BY-DEFAULT
Audit & Compliance Engineering
Control mapping, immutable audit trails, and policy-as-code — built in, not bolted on.
Compliance is an engineering problem, not a documentation exercise. When you treat it as documentation, you get gaps between what the runbooks say and what the systems do. We start from control frameworks — SOC 2 Type II, HIPAA Security Rule, GDPR Article 32, ISO 27001, DORA — and map each control to a concrete system behaviour: a Kubernetes network policy, a Vault secret lease, a GitOps change gate. Every configuration change is a git commit with author, timestamp, and review chain. OPA or Kyverno policies enforce constraints at admission time. The result is audit evidence that is generated continuously by operations — not assembled under deadline in a spreadsheet.
≤ 4h
Evidence assembly time per control (representative target)
for teams with GitOps + policy-as-code already in place vs. days for manual assembly
Deliverables
Control mapping document
Every applicable control from SOC 2 / HIPAA / GDPR / ISO 27001 / DORA mapped to a specific technical implementation — policy, system, or process — with evidence pointer.
Policy-as-code implementation
OPA / Kyverno policies for: image provenance (signed images only), resource limits enforcement, namespace isolation, prohibited capabilities, and audit logging.
Immutable audit trail
Git history as the change record, plus runtime audit logging (Kubernetes audit log → Loki) with tamper-evident retention and query capability for auditors.
SBOM & supply-chain attestations
Syft-generated SBOMs for every container image, signed with Cosign under Sigstore, stored in a verifiable transparency log. SLSA Build Level 2 pipeline configuration.
Data lineage map
Where sensitive data enters, how it flows through services, where it is stored, encrypted, and deleted — mapped to specific system components and retention policies.
KubeVigil continuous posture monitoring
Our open-source Kubernetes security posture tool wired into your cluster — real-time findings, policy deviation alerts, and evidence export in audit-ready format.
Stack
Trade-off
Rigor vs. velocity — and the false dichotomy
The standard objection to audit-grade engineering is that it slows teams down: policy gates block deploys, change control adds latency, evidence collection consumes engineering time. That is true of compliance systems bolted on after the fact — they create friction because they are fighting the way the system was built. When controls are designed in from the beginning — GitOps as the only change path, policy-as-code as an admission gate, infrastructure-as-code as the source of truth — compliance evidence is a byproduct of normal operations. Deploys are faster because every change is reviewed and auditable before it lands. The cost is upfront: the system takes longer to design. The benefit compounds: each subsequent audit cycle is cheaper, not more expensive.
WHAT YOU KEEP
We build to leave
Every engagement ends with a transition package: runbooks written by the people who built the system, incident playbooks tested against real failure modes, ADRs that capture every architectural choice, and a team that has operated the stack in parallel before we step back. We do not design for dependency. The measure of a successful engagement is whether your team would hire us again because they want to — not because they have to.
- Runbooks written by the engineers who built it
- Incident playbooks tested against real failure modes
- Architecture Decision Records for every major choice
- Parallel operation period before handoff
- Team readiness checklist with gap assessment
- 30-day post-handoff support window
§00/The Five Pillars
Sovereignty
OWN-THE-PERIMETER
Engineering teams owning the full stack they depend on — no invisible landlords, no rented foundations.
Open source as method
OSS-AS-DISCIPLINE
Open source is a discipline of review, contribution, and independence — not a license type to tick on an audit form.
Audit-grade rigor
EVIDENCE-BY-DEFAULT
Security and compliance aren't retrofit — they are the bar that makes self-hosting safe in regulated, serious environments.
Optionality
EXIT-RAMPS-DESIGNED-IN
Anti-lock-in by architecture: every layer has a documented exit ramp so no vendor can hold you hostage.
The long game
BUILT-FOR-DECADES
Systems proportioned to outlast the tools, vendors, and leadership changes that will come in the decade after delivery.
Executive Briefing
Thirty minutes to clarify your infrastructure risk
Walk us through your vendor footprint and regulatory constraints. We will tell you honestly where sovereignty creates leverage — and where it does not. No pitch deck. No obligation.