GitOps via Argo or Flux, multi-tenant isolation, autoscaling with Karpenter, per-workload cost attribution, and observability. We build the internal developer platform your team self-serves on, then hand you the receipts your acquirer asks for.
The platform is the product floor. We build the internal developer platform your team self-serves on, then prove it on the diligence call. Thirteen K8s platforms shipped since 2020.
“The platform is the product floor. We build it, then prove it on the diligence call.”
K8s platforms shipped since 2020 on EKS, GKE, and AKS.
Production incidents on shipped platform engagements.
Fixed-scope audit. 30-page brief, six ADRs, fixed-price quote.
A UK SaaS scale-up tried it in-house for six months: two engineers part-time, no observability, no audit log, a runbook on a Confluence page. The acquirer’s CTO walked the codebase pre-LOI and said one thing: “rip and replace, or take a 25% diligence haircut.”
The platform wasn’t a side quest. It was the product floor, and it had been treated as something one engineer would tidy up later. No GitOps, no cost attribution, no disaster-recovery rehearsal, bus factor of one.
We rebuilt over 12 weeks. Senior engineers paired daily, ADRs documented same day, the evidence pipeline wired on day one. The acquirer’s CTO came back, walked the same surface, and signed full-team retention. This page is for the CTO who decided the platform is the product floor and wants it built, not bought as a tool.
Each one is the difference between a platform your team trusts and one they route around.
“A workflow died silently. The customer found out before we did.”
Per-workload observability and alerting. Prometheus + OpenTelemetry traces. PagerDuty and Slack alerts on the signals that matter. The customer never finds out first.
“Who did what, when? No record. The SOC 2 auditor flagged it.”
Audit log per mutation, GitOps history end to end. Every cluster change recorded in Git and in the audit log. Tenant-admin viewable. The auditor is satisfied.
“The cloud bill spiked. Nobody could say why. The cluster is 80% of it.”
Per-workload cost tags and budget alerts. OpenCost attributes every pound. Karpenter and right-sizing trim the waste. The bill stabilises within 30 days.
“The backup runs. The restore was never tested. A disaster would be career-ending.”
Restore rehearsed quarterly. Velero backups. RTO and RPO documented and drilled on the calendar. Restore in under four hours, proven.
“One engineer knows the cluster. Our bus factor is one.”
Two-senior pairing and ADRs same day. Two senior engineers paired daily, decisions written down the day they’re made. Your bus factor goes to four, then to your team.
“An enterprise prospect asked for SOC 2, a DPA, a sub-processor list. We had none.”
Procurement pack from day one. SIG-Lite, CAIQ, DPA, SCCs, and a SOC 2 stance shipped day one. Procurement clears in days, not quarters.
“One customer’s job pegged the cluster and everyone else slowed down.”
Quotas, limits, and network policy per tenant. Resource quotas and limit ranges per namespace. Network policy isolates tenants. One noisy job can’t starve the rest.
“Someone kubectl-patched prod at midnight. Now the cluster doesn’t match anything in Git.”
GitOps with drift detection. If it isn’t in Git, it doesn’t survive. Argo or Flux reverts manual changes. The repo is the source of truth, enforced.
The internal developer platform, built once, run by your engineers. No ticket queue. No bus factor of one.
Declarative deploys from Git. Progressive rollout, automatic rollback, drift detection. The cluster matches the repo, always.
Node and pod autoscaling tuned to your traffic. Spot instances where it’s safe. Scale-to-near-zero on quiet workloads.
Per-namespace, per-workload, per-tenant cost. Budget alerts. The answer to “why did the bill spike” in minutes.
mTLS between services, traffic shaping, canary releases, retries and timeouts at the mesh layer. Wired only when you need it.
Prometheus + Grafana + OpenTelemetry. Dashboards your on-call actually opens. Alerts to PagerDuty and Slack, not a void.
External Secrets, Vault, OPA Gatekeeper. Nothing ships that violates policy. Secrets never live in a YAML file in Git.
Git as the source of truth. Terraform underneath. The hiring pool that means your next platform engineer is productive on day one.
What changes when the platform is built as the product floor, not patched as a side quest.
GitOps via Argo, multi-tenant isolation, Karpenter autoscaling, per-workload cost attribution, observability end to end, evidence pipeline live day one.
We rebuilt an in-house cluster as an acquirer-defendable platform: GitOps via Argo, multi-tenant isolation, Karpenter autoscaling, per-workload cost attribution, observability end to end, evidence pipeline live day one.
You bound the risk at week one. A £8K audit before a single line of platform code ships.
Two senior engineers read your estate and brief, then write it all down.
Eight to fourteen weeks of fixed-scope shipping, audit-led and evidence-first.
One day a week of a senior engineer for three to six months.
Pain-first, soft-second.
The audit is £8K, fixed. The sprint is typically £45K to £110K, fixed-price, scoped at the end of the audit. No day-rate, no scope creep. You see the number before you commit, and you decide whether to continue after week one.
No. We work in place where possible. If a migration makes sense, we scope it at the audit and run the old and new in parallel until you sign off. We’ve never forced a rip-and-replace that wasn’t the cheaper option for the client.
An ADR pack, an audit log, a GitOps history, an evidence pipeline, and a SOC 2 stance. The acquirer’s CTO walks the surface and signs full-team retention. That happened three times across 2024 and 2025. We don’t ask you to take our word for it; the receipts do the talking.
Yes. We default to EKS on AWS because that’s where most UK SaaS already runs and the hiring pool is deepest. We’ve shipped GKE for ML-heavy products on Google Cloud and AKS for enterprise clients with Microsoft contracts or NHS Azure tenancies. The lock-in path is documented either way.
Usually, yes. We wire per-workload cost attribution with OpenCost so you can see where the money goes, then right-size requests, add Karpenter for node autoscaling, and move safe workloads to spot. A 30% cut on cluster spend inside the first 30 days is a typical outcome, not a promise.
Every engagement has two senior engineers paired, not one. Every decision goes into an ADR the same day, and the whole platform lives in Git. Two handovers in seven years, both inside 48 hours. Your bus factor is never one with us, and it isn’t one when we leave.
No, the opposite. We ship on standard Kubernetes, Terraform, Helm, and Argo, the most hireable platform stack in the UK in 2026. GitOps means your next engineer reads Git and is productive on day one. We also train your eventual hires during the engagement.
It’s built to. The evidence pipeline goes live in week one, SOC 2 Type 1 is achievable in 8 to 12 weeks if you don’t have it, and the DPA, SCCs, and DSAR runbook ship by default. We’ve been through these diligence calls, and the platform is built so they’re short.
A look at the kind of kubernetes platform engineering surface we hand over — real screens, real data, documented and yours from day one.
Tell us your current estate, your deadline, and the outcome you need. Mohit replies inside 24 hours: a clear yes, a clear no, or the one question that decides it, plus the next audit slot.
Yes, no, or the deciding question. Straight to your inbox.
30-page brief, six ADRs, a risk matrix, a fixed-price quote.
GitOps, autoscaling, cost attribution, observability, DR rehearsed.