We build and run the delivery pipelines behind regulated Nordic platforms. Infrastructure as code, signed artefacts, policy gates — and audit evidence produced as a by-product rather than assembled the week before an assessment.
Most teams can pass an audit. Fewer can pass one without three weeks of an engineer screenshotting consoles and writing narratives about what probably happened.
When provenance, policy decisions and deploy attestations are written at the moment they occur, the assessment becomes a query against a record rather than an archaeology project.
That is the whole of the offer. Everything below is detail.
Nothing here is a package. Each engagement is shaped around the partner’s existing stack, tooling and contract structure — we adopt yours rather than asking you to adopt ours.
| Model | Shape | Typical fit |
|---|---|---|
| Pilot | A department-scale piece of work with its own budget and an agreed success test. No framework agreement or long-term commitment needed to start. | A first engagement with a new partner or business unit |
| White-label subcontract | We work under your brand, inside your runbooks and tooling. Your client never meets us. | MSSPs and systems integrators needing surge or specialist capacity |
| Embedded engineer | We join your team — your standups, your repositories, your review process. Billed per engineer, per month. | Platform teams carrying more infrastructure than headcount |
| Scoped project | Fixed outcome and fixed window, with the acceptance criteria written before work starts. | Migrations, pipeline rebuilds, audit readiness |
| Response retainer | Reserved capacity with an agreed response window, drawn down as needed. | Platforms that cannot wait for a statement of work during an incident |
Rates are quoted before scoping. Embedded work is priced per engineer per month, scoped projects are fixed price, and retainers are a reserved monthly fee. There is no minimum term beyond the one written into the agreement.
Engagements are built to end cleanly. Infrastructure is defined in code that lives in repositories you own, and we sell no software of our own — so there is nothing left to keep licensing after we leave. Exit terms are fixed in the agreement before work starts, not negotiated when you want to go.
Swedish buyers assess compliance from three sources at once: what the law requires, which standards evidence it, and what the supplier has itself committed to. Set out below across the four areas that apply to an IT service. Our own position is stated plainly.
| Area | Law that applies | Standards | Our position |
|---|---|---|---|
| Cybersecurity | GDPR · NIS 2 · Cyber Resilience Act. Protection of customer assets, access control, defence against digital threats. | ISO/IEC 27001 · IEC 62443 | We notify partners of security incidents within the time set in the agreed SLA, fixed so that it fits inside your own NIS 2 or DORA reporting deadline. |
| Code of conduct | Swedish anti-bribery rules · labour law · tax transparency · beneficial-ownership disclosure. Ethical practice, human rights, fair treatment. | ISO 37001 · ISO 26000 · UN Global Compact | We neither give nor accept gifts or hospitality from clients or partners. Everyone working on an engagement does so under a written contract. We are tax-registered and up to date in Moldova, with a certificate of no arrears available on request, and our beneficial owners are disclosed to clients and partners when contracting. |
| Environmental | CSRD reporting cascading through supply chains · WEEE · EU and Swedish environmental law. Energy use and resource efficiency. | ISO 14001 | We run no hardware of our own; client workloads run on the cloud the client has chosen. Right-sizing resources and removing idle infrastructure are routine parts of our work, and where a client reports under CSRD, the relevant figures — regions, resource sizing, what was removed — can be included in our infrastructure-as-code reports or routine updates. |
| Intellectual property | Copyright, trademark and licensing obligations, including open-source compliance. IPR allocation fixed in the engagement agreement. | SBOM — SPDX / CycloneDX | Work produced for a client belongs to the client. Tools of our own that we bring to an engagement stay ours, and the client keeps a free, permanent right to use whatever of them remains in its systems. The agreement lists which is which. |
Founder · Principal engineer
You will not be routed through an account manager. The person who scopes the work is the person who does it, and remains reachable for the life of the engagement.
Cloud infrastructure and delivery engineering for regulated platforms — payments, point-of-sale, high-availability SaaS — across AWS, Azure and GCP.