Case studies

Whole projects, told end to end: the situation, the constraints, what we built, the code that did it, and the results it brought. Clients are anonymised; the engineering is not.

• A global industrial manufacturer

  Three years running a manufacturer's hybrid estate

  We measured that 95% of an industrial manufacturer's monitoring tickets closed themselves, then moved its monitoring to New Relic in a way that cut redundant alerting by about 80%, by our records.

  About 650 monitoring tickets in 30 days, 95% closing themselves and none resolved at first line: the baseline we measured before the move.

  • New Relic
  • Zabbix
  • ServiceNow
  • AWS
  • Azure

• A global industrial manufacturer

  An engineering simulation cluster on Azure scale sets

  We rebuilt and ran an industrial manufacturer's engineering simulation clusters on Azure scale sets, and after five rebuilds in about nine months moved every new node onto a golden image.

  Two working SLURM clusters on HB-series scale sets, with home directories and shared data served over InfiniBand.

  • Azure VM Scale Sets
  • HB-series with InfiniBand
  • SLURM
  • MUNGE
  • NFS over InfiniBand

• A North American medical-device company

  Infrastructure for a medical-device company's clinical platform

  Since December 2024 we have run the infrastructure under a medical-device company's clinical platform, and today no deploy opens SSH from CI to any of its hosts.

  No deploy opens SSH from CI: host addresses, ports and private keys left the CI secrets in January 2026.

  • AWS EC2
  • VPC
  • RDS
  • Docker Swarm
  • Docker Compose

• A multi-region clinical platform

  Running a three-region clinical platform on self-hosted Swarm

  We moved a clinical platform's deploys in three regions from blind webhooks to runners inside each cluster, so a deploy job now fails when the service update is rejected.

  12 production targets moved in three days: four apps in three regions taken off webhook deploys through 20 pull requests, 19 merged.

  • Docker Swarm
  • GitHub Actions
  • self-hosted runners
  • Traefik
  • Azure

• A US healthcare company

  Edge hardening for a small health API

  We put a small health API behind a free-plan Cloudflare edge, and within a day the share of requests reaching its server fell from about 90% to about 65%.

  Requests reaching the origin down from about 90% to about 65% of traffic over the next 24 hours (814 of 902 before, 492 of 757 after).

  • Cloudflare (WAF
  • cache rules
  • Origin CA)
  • nginx
  • Docker Compose

• A European manufacturer

  Automating application support on a legacy Java estate

  We replaced a manual morning check on a manufacturer's financial reporting application with a generated daily report and alert-once monitoring, and proved every health check by breaking what it watched.

  A daily report built from the servers' own history and mailed every morning, replacing a manual check across both stages.

  • RHEL 7
  • Apache Tomcat
  • Microsoft SQL Server
  • Flyway
  • NFS

• An event-ticketing platform

  A multi-tenant ticketing platform: zero-downtime releases and a payment path tested against double charges

  We build and run a multi-tenant ticketing platform whose largest release applied eight database migrations in under 20 seconds and served the old code on the new schema for about 2.5 minutes with zero errors.

  Eight migrations in under 20 seconds in the September 2026 release, then about 2.5 minutes of old code on the new schema with zero errors and production answering 200 throughout, as observed in logs and monitoring.

  • Next.js
  • TypeScript
  • PostgreSQL
  • Prisma
  • Stripe

• An events and entertainment brand

  Moving an events brand off WordPress, with one gated path to production

  We moved an events and entertainment brand off WordPress onto one application whose only road to production is a test-and-audit gate, and resolved every legacy URL that search engines reported as missing.

  One gated path to production since July 2026. Every production deploy passes a dependency audit and the unit suite; lint joined the gate on September 6, 2026.

  • Next.js
  • React
  • TypeScript
  • Prisma
  • Postgres (Neon)

• A festival bar operator

  Offline upgrades for a festival bar's inventory system

  We built a festival bar operator's stock and cash-flow system to upgrade its Docker-hosted database on a box with no internet, with every upgrade path rehearsed first on a restore of real event data.

  Upgrades rehearsed on a restore of the newest production backup before a bundle ships, with an invariant battery that runs again on the box after every install.

  • Docker Compose
  • PostgreSQL
  • Alembic
  • FastAPI
  • Next.js

• Our own product

  A nightly batch pipeline that cannot report an empty run as success

  We rebuilt our own nightly Docker pipeline on one small VM so that a run that delivers nothing fails with a written reason, and cut its runtime from 2h43m to under an hour.

  Nightly runtime fell from 2h43m45s (91% of a three-hour cap) on September 2, 2026 to 54m59s (17% of a five-hour cap) on September 5, and all eleven nights from September 20 to 30 exited clean.

  • Python
  • Docker Compose
  • systemd
  • PostgreSQL (managed)
  • Prisma

• Our own product

  Empty runs and correct billing for pay-per-result scrapers

  We built a small shared kit that makes our paid scraping jobs fail with a plain reason when they deliver nothing, and it found a latent defect in every job that adopted it.

  A shared zero-row guard, adopted by five actors, surfaced a latent defect in each one, including a default configuration that returned 0 rows instead of 25 and a partial block that threw away 245 fetched rows.

  • TypeScript
  • Node.js
  • Python
  • Apify SDK
  • Crawlee

• Our own infrastructure

  How we run our own infrastructure as code

  We rebuilt the pipeline for our own Terraform estate so that a merge only ever produces a plan, and every apply, destroy check included, works on the plan file we reviewed.

  Four near-duplicate CI workflows (about 1,240 lines) replaced by one caller and one reusable stack workflow, and no stack applies on merge.

  • Terraform
  • GitHub Actions
  • AWS (OIDC)
  • Cloudflare
  • New Relic

• Our own tooling

  A validated security sweep for production web apps, without a scanner bill

  We built a repeatable security sweep for the web apps we run and maintain, and it reports only what it can prove: every finding comes with a file and line or a reproduced request.

  Three production web apps swept, code and live, each in under ten minutes of collection.

  • gitleaks
  • trivy
  • semgrep
  • nuclei
  • Docker