HOME / CONSULTING

We design it,
then we run it.

Architecture, security and compliance for businesses that cannot afford to be wrong about them — led by a founder who has built national-scale infrastructure, and who still signs the architecture.

Book a 30-min diagnostic Who you would be working with
25years of critical infrastructureBANKING · ENERGY · IDENTITY · LEGAL
8Musers on a system we co-builtitsme® · eIDAS CERTIFIED
200+attorney firm secured as CISONO MAJOR INCIDENT OVER THE PERIOD
0slide decks as a deliverableWE OPERATE WHAT WE DESIGN
01 — HOW AN ENGAGEMENT RUNS

Four steps, and you can stop after any of them.

Most consulting ends at the recommendation, which is the cheapest part to produce and the least useful to receive. Ours is priced so that stopping early is a real option and continuing is not a new negotiation.

01 · Diagnosis
Two to three weeks. We read the estate, interview the people who actually operate it, and come back with what is true rather than what the documentation says. DELIVERABLE: FINDINGS WITH SEVERITY, EFFORT AND SEQUENCE
02 · Architecture
The target design and the path to it, in a form a builder can price — including what to decommission, which is usually the part that pays for the project. DELIVERABLE: TARGET ARCHITECTURE · MIGRATION SEQUENCE · COST MODEL
03 · Build & deploy
Our DEV-TEAM and OPS build it and put it into production on infrastructure we operate, or on yours. Where JARVIS is involved it is deployed and connected, not demonstrated. DELIVERABLE: RUNNING SYSTEM · MONITORING · RUNBOOKS
04 · Transfer
Your team takes it over: documentation, training, and a period where we are on call while they operate it. If you would rather we kept running it, that is a managed contract. DELIVERABLE: SKILLS TRANSFER · OR A MANAGED SERVICE
02 — THE PRACTICES

Six practices. One bench.

Every certification below was earned on a system that was in production at the time. Where a claim has a limit, the limit is written next to it.

IT & enterprise architecture
The map of how your systems fit together, and then the systems. Enterprise architecture at group level, solution and infrastructure design across servers, containers, serverless, cloud and sovereign EU self-hosting, and API-first integration — REST, webhooks, MCP — including the legacy estate nobody wants to touch. TOGAF · ARCHIMATE · API-FIRST · SOVEREIGN EU SELF-HOSTING

You leave with: A target architecture you can build against, and the interfaces to reach what you already own.

Cybersecurity
CISO as a service: security policy, risk management and governance, run by someone who held Head of Security at a business law firm of 200+ attorneys. ISO 27001 programmes from gap analysis through to audit. Penetration testing on web and mobile, and — through Digi.Lab — on the hardware itself: RFID and NFC, chip-off, JTAG. CISSP · ISO 27001 LEAD IMPLEMENTER · GWAPT · GMOB · GICSP · PCI

You leave with: A defensible security posture, evidenced — the thing your own clients will ask you for.

Governance & compliance
eIDAS lived from the inside: co-creating a national digital identity means the certification was not read, it was passed. GDPR and the EU AI Act designed in rather than retrofitted, because our own products ship under them. Continuity and resilience: BCP, DRP, and what digital sovereignty actually costs. eIDAS · GDPR · EU AI ACT · BCP / DRP · DIGITAL SOVEREIGNTY

You leave with: Compliance as a property of the system, not a folder of policies nobody reads.

Audit
Full IT and security audits, and due diligence for investors and management. CI/CD and delivery audits where we verify the quality gates actually execute rather than that they exist — the two are not the same, and the difference is usually where the incident came from. Blockchain forensics for on-chain investigation and tracing. IT & SECURITY AUDIT · DUE DILIGENCE · CI/CD · BLOCKCHAIN FORENSICS

You leave with: A findings report with severity, effort and sequence — not a list of everything that could theoretically be wrong.

AI transformation & automation
Our core practice since 2021, and the one where most of the money in this market is currently wasted. AI strategy for executives in critical sectors: where it pays and where it burns cash. Autonomous and multi-agent architecture in production, not in demos. RAG and knowledge systems, model selection and routing, orchestration, and media generation pipelines. AGENT ARCHITECTURE · RAG · MODEL ROUTING · n8n · MEDIA PIPELINES

You leave with: Automations that run unattended with a cost per run attached, and your team able to change them.

Data & growth technology
The measurement layer, built first-party and cookie-resilient so it survives the next browser change: GA4, server-side GTM, BigQuery, conversion APIs. SEO with AEO and GEO on top, because being retrievable by an AI engine is now a separate discipline from ranking. Attribution from raw tracking through to board-level numbers. GA4 · SERVER-SIDE GTM · BIGQUERY · CAPI · SEO / AEO / GEO

You leave with: Numbers you can act on, and an honest account of what cannot be attributed.

03 — TWO WAYS TO WORK

Advisory

You have the team; you need the design, the review or the second opinion that carries weight with a board. Fixed scope, fixed fee, and a named senior consultant — not a pyramid with a partner's face on the cover.

Advisory and build

We design it and then we deliver it, on our infrastructure or yours, with the operation handed over or retained. This is the majority of what we do, and it is the only way the design gets tested against reality.

04 — THE HONEST PART

What we will tell you not to do.

Do not start with AI

If the process is undefined, automating it multiplies the confusion. Two thirds of the AI projects we are asked to rescue were automations built on a process nobody had agreed.

Do not buy the platform first

Tooling decisions taken before the architecture are the most expensive kind to reverse. We have unwound enough of them to recognise the pattern in the first meeting.

Do not certify what you do not run

An ISO programme on top of an estate nobody operates properly produces a certificate and no security. Fix the operation, then certify it.

Thirty minutes, and you leave with a roadmap.

No slides. We open the hood, show you what is already running here, and name the two or three things worth doing first — including when the answer is that you do not need us.

Book the diagnostic See your industry