What we do
Fixed-price productized engagements for 10–40-engineer Seed/A startups on AWS — delivered as infrastructure-as-code (and, for new SaaS, as the application repo) that the client owns from day 1.
- AWS Production Foundation 4–6 weeks
- Multi-account AWS Organization, IAM Identity Center, 3-tier VPC, centralized logging — with the Core+ tier adding audit-grade hardening to CIS Benchmark + AWS FSBP with GuardDuty, Inspector, and preventive SCP / RCP guardrails. Core+ also bundles our engineering-platform foundation: Terraformed GitHub, an agent-agnostic AI skills repository (Claude Code, Cursor, or any agent that accepts a system prompt + tool allowlist), and a developer-onboarding CLI that gets a new engineer productive in hours.
- ECS Application Platform & Deployment 5–6 weeks
- The production ECS pattern we run on our own SaaS apps, plus your first app deployed end-to-end. Shorter when the ECS substrate already exists, and each additional app on the same account reuses it.
- Software Engineering Application Bootstrap 5 weeks
- The inside of the repo — a typed multi-tenant Bun / TS monorepo with a drift-checked API client, Clerk auth, worker idempotency primitives, security middleware, and a test harness wired the way we run our own production apps.
Most engagements combine two or three of these — combinations and sequencing are negotiated per deal, not picked from a fixed bundle menu. The repo is yours from day 1.
No retainer required. You own the code from day 1.
What we don't do
The lines we name out loud — so the engagement reads the same way after signature as it did on the homepage.
- We don't run your AWS for you. After the engagement, you own it.
- We don't write your SOC2 / ISO / HIPAA policies — that's your auditor and your CSO.
- We don't sell the SOC2 audit — pair us with Vanta / Drata / Secureframe.
- We don't take engagements where the buyer isn't an engineering leader or has an engineering team. Wrong audience.
How we work
Five operating defaults. They show up in every Statement of Work and every Scorecard call.
- One engagement at a time.
- Quality over volume. Founder-led means the founder is on it.
- Fixed scope, fixed price, fixed timeline.
- The IaC repo lives in your GitHub organisation from day 1. No surprises in week 5.
- Honest tradeoffs.
- If something is out of scope, we say so up front — on the Scorecard call, in the SoW, and on the product pages.
- Long engagements ship as phases.
- Multi-product engagements longer than eight weeks are delivered as sequential phases with a clean handover between them. Protects delivery quality; lets you pause if priorities shift.
- Public engineering deep-dives.
- Every project produces a write-up on the architecture decisions worth defending. Read them in the engineering log.