What we do, and what you get at the end of it.
Each service stands on its own. Most companies take them in this order, because the first one tells you whether the other two are worth paying for.
Choose the right AI and cloud
For teams paying for models without knowing what each one is for.
Vendors publish prices and benchmarks. Neither tells you what a model costs you per task, because that depends on how long its answers are, how often it reasons out loud, and how often your traffic has to fall back to a second model. We measure those on your own requests, against the models you can actually reach from your region.
Model fit, by job
A tier map: the smallest model that finishes each kind of work reliably, a larger one for the work that needs it, and a fallback that is used rarely rather than constantly. With the cost per request behind every line.
Cloud and provider selection
Huawei Cloud, AWS, Google Cloud, or a mix. We weigh region, data residency, the compliance evidence each one can give you, and what your bill looks like at twice today's volume.
Spend and quota alerts
A warning before a model quota or a cloud budget runs out, so a report does not fail silently on a Friday.
Build agents and automation
For work your team does by hand every week and should not.
An agent is only useful if it can be trusted near production. Ours propose before they act, show the change they intend to make, and stop at an approval gate for anything that touches production or moves money. That gate cannot be set to approve itself.
Operations agents
Deployments, environment provisioning, certificate renewal, key rotation, patching. Scheduled or on request, with a record of every run.
Reporting and reconciliation
The daily, weekly and monthly reports that currently depend on one person remembering: finance exports, partner reports, exception lists, delivered on time and checked against the source.
Compliance evidence
The evidence an assessor asks for every quarter, collected continuously instead of the week before the audit, each item citing the requirement it satisfies.
Internal assistants
A chat surface for your own team that knows your estate, answers from the facts we read every hour, and keeps card and personal data out of prompts and logs.
Secure access and prove it
For companies where "who can reach production" has more than one answer.
Most incidents are not clever. They are a shared key, a leaver who still has access, or a tool that was never put behind sign-on. We put one login in front of the whole estate: cloud consoles, servers, databases, internal tools and AI tools alike. Access is scoped by role and recorded, so the same work that makes you safer is the work that gets you through the assessment.
Single sign-on
One identity for every cloud console, server, database, internal tool and AI tool you run, on whichever clouds you run them. Joiners get what their role needs; leavers lose it the same hour.
Access by role, sessions recorded
Connect by clicking, not by passing keys around. A certificate is issued for the session, and the session is recorded so "who ran that" has an answer that does not depend on memory.
Keys and certificates on a schedule
Rotation before expiry, not after an outage. Access keys older than ninety days surfaced, dormant identities named.
Findings that cite the requirement
A database reachable from the internet. A security group open to the world. Storage left unencrypted. Each finding states the evidence it rests on and the PCI DSS or ISO 27001 requirement it sits under.
Environments
A project with a start and an end.
Development, UAT and production networks designed and built: segmentation, peering, gateways, bastion access, and the Terraform that reproduces the whole thing on demand. It is usually what comes first for a company that has grown faster than its infrastructure, because everything above needs an estate that is laid out on purpose.
Questions we get asked first
Do you resell a cloud or a model vendor?
No. We take no commission from any provider, and the review will sometimes tell you to stay where you are. Our recommendation is only worth something if it can go either way.
Does our data leave our cloud?
For the review, we read with a credential you issue and can revoke, and nothing is written. For anything we run for you, the component that holds your credential runs inside your account and sends back results, never the key. Card data and personal data do not go into prompts, and the ledger records what was sent.
Can an agent change production on its own?
Not with us. Reads run freely. Anything that changes production or moves money proposes first, shows its diff, and waits for a named person. That tier cannot be set to auto-approve, by design rather than by policy.
How is the review priced?
A fixed fee, agreed before we start, for two to three weeks of work. You keep the report whether or not we do anything further together.
Not sure which one you need?
That is what the review is for. Tell us what you run and we will say which of these applies.