FRClient portalBook a Scope Review →
Portfolio

Delivery records, by capability.

Every record pairs the requirement the client brought with the engineering that delivered it. Organised by the six services we offer.

Note: Client names stay confidential. We name sectors and outcomes here, and share details only with permission.

The full chronological record, 2011 to today, lives on the delivery history page.

Post-mortems

Deep case studies.

Six engagements written up as technical post-mortems: topology, the trade-offs we weighed and what the telemetry says.

Portfolio

Recent delivery records

AI & LLM integration

Grounded RAG assistant for a government agency

40,000 policy documents now answer themselves, with a source on every answer.

What the client needed. The agency needed citation-grade answers over 40,000 policy and operational documents, hosted inside a PROTECTED-level boundary with zero data egress, replacing a mailbox-driven enquiry process.

How we delivered it. We engineered an on-tenancy retrieval platform in Python and TypeScript: PostgreSQL with pgvector for hybrid BM25-plus-embedding search, OIDC-scoped retrieval so answers inherit document permissions, and a citation layer binding every claim to its source paragraph. Open-weight embedding models kept inference inside the boundary; a golden-set evaluation harness ran groundedness and refusal checks in CI, blocking releases below threshold. P95 answer latency 2.1 s, groundedness 0.94 at launch, security review closed with zero data-egress findings.

Enterprise AI assistant connectors at 1.2M objects

An enterprise AI assistant now reads its documents, CRM and intranet with correct permissions.

The requirement they brought. An enterprise rolling out a productivity-suite AI assistant needed its document stores, CRM and intranet connected with correct permissions and freshness.

The engineering behind it. We built Go connector services with incremental delta sync that processed only what changed between runs, mapping source ACLs onto the index so answers inherited user permissions, plus pre-index validation that quarantined malformed or stale content and Python ETL for format edge cases. A governance note documented exactly what was indexed, how retention worked and how deletions propagated. 1.2 million objects indexed; the compliance review passed without a single data-handling question.

Permissioned agentic operations platform

LLM agents now act across CRM, ticketing and documents under strict, auditable controls.

Where it started. A scale-up wanted LLM agents acting across its CRM, ticketing and document APIs under strict, auditable controls.

What we built. We delivered a Python agent framework with typed tool contracts, per-tool permission grants, human-in-the-loop approval for sensitive actions and full audit logs of every call. Task decomposition into bounded tool sequences made failures reproducible; a sandbox simulation suite caught regressions before deployment. Eleven workflows were automated, with token cost tracked per workflow.

Evaluation harness that gates AI releases

Every AI release is now gated on measured quality.

What the client needed. A product team needed LLM quality measured against a golden dataset before every release.

How we delivered it. We built a golden-dataset evaluation suite in Python scoring correctness, groundedness, tool-call accuracy and cost per run, wired into CI so a failing evaluation blocked the merge. Tracing across the agent loop showed exactly where a run diverged, and per-change quality reports made regressions discussable in code review. It became the team's default gate for shipping any model, prompt or retrieval change.

Full-stack product & app build

Merchant payments portal

Merchants onboard, report and get paid through a self-service portal, without PCI risk.

What the client needed. A payments company needed a self-service merchant portal for onboarding, reporting and payouts that could not become a PCI liability.

How we delivered it. We built a React portal in TypeScript over typed Node and Python API services, isolated from the core payments system behind a service mesh. Authentication used OIDC with role-based permissions, and every financial action was idempotent and audited. Our delivery scope handled zero cardholder data, keeping the portal in SAQ-A territory. Delivery ran in two-week increments with staging from week one; handover included a permissions matrix, integration tests and runbooks.

National clinical registry modernisation

A national clinical registry rebuilt for entry, validation, reporting and multi-clinic access.

The requirement they brought. A university-led programme needed its national clinical registry (entry, validation, reporting, multi-clinic access) rebuilt off an ageing, error-prone legacy stack.

The engineering behind it. We re-architected the registry in TypeScript and Python around a validated data model with role-based access for clinics, investigators and administrators. Point-of-entry validation caught errors where they were cheapest to fix, and a PostGIS reporting layer turned postcode data into catchment and referral maps that no spreadsheet could produce. The legacy migration shipped with a reconciliation report the client signed line by line. Fourteen clinics onboarded in the first wave.

Timed-entry ticketing for a visitor attraction

Ticketing, memberships, timed entry and on-site sales in one system before peak season.

Where it started. A visitor attraction needed ticketing, memberships, timed entry and on-site sales unified into one system before a peak season.

What we built. We delivered catalogue, availability, booking and payments services behind one customer-facing application, with the availability service written in Go for predictable latency under surge. Timed-entry capacity was modelled as inventory with reservations, so peak days physically cannot oversell. An admin console put pricing and capacity rules in non-technical hands. We load-tested to eight times average demand with a rehearsed rollback plan: opening weekend sold out with zero oversell incidents.

Embedded senior capacity for a SaaS team

Senior engineering capacity embedded in a growing SaaS team, on their process.

What the client needed. A growing SaaS company wanted a polished admin and analytics area plus senior engineering capacity inside its existing process.

How we delivered it. We embedded into their sprints and shipped user management, billing views, feature flags and an analytics dashboard in their TypeScript stack, matching their conventions and CI. Tests and documentation landed alongside every feature, so the client's own velocity improved. The code reviewed as native to their repository; the handover needed no translation layer.

Cloud, DevOps & platform rescue

Browser-test CI/CD farm

Thousands of UI tests that took over an hour now run fast and cheap.

What the client needed. A browser-focused product ran thousands of UI tests that took over an hour and cost a fortune to run.

How we delivered it. We redesigned the pipeline around ephemeral parallel runners on autoscaling instances, defined fully in code, with cached browser binaries and dependencies. Flaky tests were quarantined and reported in every run summary, and a canary stage caught regressions before full rollout. Feedback fell from 68 minutes to under 6, and the pay-per-run model cut test infrastructure spend by a third.

GitOps reliability for a payments platform

Deploys are now declarative, auditable and reversible, no more recurring incidents.

The requirement they brought. A payments platform wanted deploys declarative, auditable and reversible after recurring incidents.

The engineering behind it. Infrastructure and application configuration moved to GitOps with a single-pull-request path to production, review gates and automatic rollback on failed health checks, replacing a change-board ritual with reviewed code. Golden-signal dashboards and on-call runbooks were tied to alert thresholds. Mean time to recovery fell from four hours to 22 minutes, and every change became auditable in Git.

Multi-tenant Kubernetes for data and ML teams

One Kubernetes foundation for pipelines, Earth-observation ingest, geospatial analytics and ML serving.

Where it started. A platform team needed one Kubernetes foundation for data pipelines, Earth-observation ingest, geospatial analytics and ML model serving.

What we built. We provisioned a multi-tenant cluster with namespaces, resource quotas and network policies, standardised Python workload packaging so teams deploy with one command, and added horizontal autoscaling, GPU node pools, persistent pipeline storage and a security-patched base-image pipeline. A PostGIS-backed web GIS portal shipped on the same foundation. Nine teams onboarded; infrastructure stopped being the bottleneck.

Cloud cost and reliability audit

A climbing cloud bill and recurring incidents, diagnosed, with a fix plan and the first fixes shipped.

What the client needed. A company with a climbing bill and recurring incidents wanted a diagnosis, a fix plan and the fixes applied.

How we delivered it. We audited usage, architecture and the deploy process, ranked findings by cost and risk with scripted Python analysis across the full audit scope, removed idle and oversized resources, right-sized databases and fixed the top reliability failure modes around deploys and missing alerts. A finance-readable cost dashboard and an engineering backlog shipped with it. The audit paid for itself in the first billing cycle, with a 34% run-rate reduction.

Data & MLOps

Governed analytics engineering

Metrics everyone trusts, no more weekly hand-stitched spreadsheets.

What the client needed. A media organisation needed metrics everyone trusts, without weekly hand-stitched spreadsheets.

How we delivered it. We built a dbt transformation layer on a cloud warehouse with tested, documented SQL models and a naming convention the whole organisation could follow. Data-quality and freshness tests ran in CI, so a broken source failed loudly at the test stage and reports stayed clean. One governed definition per metric; dashboards people stopped double-checking in spreadsheets. 140 metrics certified.

Real-time event platform

Live features and analytics on high-volume event streams, including fleet telemetry.

The requirement they brought. A product company wanted live features and analytics on high-volume event streams, including GNSS-positioned fleet telemetry.

The engineering behind it. We designed streaming ingestion with schema validation at the edge, idempotent stream processing and explicit late- and duplicate-event handling, landing into a warehouse zone with full replay. GNSS fix quality was checked before position events fed features. Sub-second feature data with the warehouse consistent, monitored continuously on lag and error rates.

Document intelligence at 2.4M pages

2.4M pages turned into structured, searchable data, replacing manual keying.

Where it started. An organisation needed structured data extracted from millions of pages for search, records and workflow automation, replacing manual keying.

What we built. We built a Python pipeline with OCR where required, classification and entity extraction combining rule-based checks with open-weight LLM extraction, and human review only below confidence thresholds. Lineage and audit trails showed where every extracted value came from, which was the compliance team's condition for sign-off across 2.4 million pages.

Market data pipeline with exactly-once semantics

Market data with strict correctness under low latency, exactly once, no more, no less.

What the client needed. A trading-adjacent platform needed market data with strict correctness under low latency.

How we delivered it. We delivered a Go and C++ ingestion path with exactly-once semantics, per-symbol in-order processing, validation against reference data, and detection of sequence gaps and latency spikes, with replay for backfills. Correctness over cleverness: the client trusts the numbers, which was the whole point.

Security & compliance engineering

Detection and response engineering

Faster, more defensible incident response for a security team.

What the client needed. A security team wanted faster, more defensible incident response.

How we delivered it. We built detection rules over existing telemetry, automated the noisy majority of triage with scripted correlation, and turned runbooks into executable playbooks with owners and timelines. An evidence pipeline captured what was done, when and by whom. Time-to-detect and time-to-respond both fell by more than half, and post-incident reviews became audit-ready by default.

AppSec embedded in delivery

Security that ships with every release, without slowing the team down.

The requirement they brought. A fast-shipping product team needed security that did not slow releases.

The engineering behind it. We introduced threat-model checklists per feature, wired SAST and dependency scanning into CI, and manually reviewed the highest-risk paths: authentication, payments and file handling. Findings were ranked by exploitability so the team fixed what mattered first. Security stopped being a bureaucratic gate because it caught real issues.

CIAM for a customer platform

Modern identity as a resilient service behind one hardened login layer for every app.

Where it started. A customer-facing platform needed modern identity delivered as a resilient, centralised service.

What we built. We designed a CIAM service around OAuth/OIDC with social and enterprise federation, fine-grained roles and tenant isolation. Token lifecycle, session revocation and consent management were handled centrally, and the login path was load-tested at twelve times baseline traffic. Product teams now inherit a single hardened identity layer for every application they ship.

GRC evidence system

Audit-ready evidence, controls documented, evidence defensible.

What the client needed. A company preparing for audits needed controls documented and evidence defensible.

How we delivered it. We mapped existing controls to the relevant frameworks, identified gaps, and built a lightweight evidence system collecting proof by API where possible, versioning the artefact behind each control. Plain-language control descriptions let auditors and engineers agree on what a control means. Audit preparation became a continuously updated process, ready whenever an audit arrived.

Systems integration & modernisation

EDRMS migration and integration

A records system replaced, with every record and retention rule preserved.

What the client needed. An organisation replacing its records system needed migration, integration and record-keeping compliance.

How we delivered it. We mapped four decades of legacy metadata to the new model, built a migration pipeline with validation and audit trails, and integrated the records system with the applications that create documents through typed APIs. Retention and disposal rules were enforced in the new workflow. A reconciliation report let the client verify nothing was lost across 2.1 million records.

ERP overlay application

Modern workflows on top of the ERP, without destabilising the core.

The requirement they brought. An enterprise wanted modern workflows on top of its ERP without destabilising the core.

The engineering behind it. We built a TypeScript full-stack application talking to the ERP through its APIs, with custom logic kept outside the core so upgrades stay safe. Event-driven sync provided real-time data, and an approval workflow matched the client's processes. The ERP remains the system of record; users finally got a modern experience on top of it.

Integration middleware with typed contracts

Reliable data movement between back-office systems, on typed contracts.

Where it started. An organisation with several back-office systems needed reliable data movement between them.

What we built. We designed integration services in Go with typed contracts, message queues and dead-letter handling so no message is silently lost, added contract tests between systems, and monitored queue depth and error rates. The tangle of point-to-point scripts was retired into one documented integration layer.

Strangler-pattern legacy modernisation

A business-critical legacy app modernised piece by piece, while it keeps running.

What the client needed. A business-critical legacy application was hard to change and risky to deploy.

How we delivered it. Characterisation tests pinned existing behaviour before anything changed. New services in Go and TypeScript took over features incrementally behind a routing layer, with parallel-run verification at every step. The client received a modern, testable codebase gradually, each step shippable and reversible: no multi-month freeze, no cliff.

Applied R&D

Optically-steered discharge beamline

A beamline that steers an electrical discharge with light.

What the client needed. A research group needed a reconfigurable, low-power way to define and steer discharge paths in air without repositioning hardware.

How we delivered it. We built a beamline with vortex and Airy beam shaping and SLM/MEMS steering, trapping absorbing microparticles to seed a low-threshold channel. A real-time C++ control stack with Python orchestration let the team redraw the discharge path in software, with closed-loop feedback holding the channel against drift. The bench system turns arbitrary 3D paths into guided discharges, documented with safety interlocks.

Absorber-particle engineering for guided breakdown

Engineered particles that guide where the breakdown happens.

The requirement they brought. A research team wanted to understand how particle material and absorption tune the guided-discharge threshold.

The engineering behind it. We screened graphene, metal and dielectric microparticles, characterising absorption, heating and threshold reduction with an automated Python sweep harness, and consolidated the findings into a selection guide. Metal particles with sharp tips added field concentration; graphene maximised density reduction. The work produced a reproducible dataset and a particle-replenishment design.

Steerable corona for static-charge dissipation

Static charge dissipated with a steerable corona, no contact, no damage.

Where it started. An aviation programme needed controlled, low-current static bleed from composite surfaces without metal wicks.

What we built. We developed a steerable corona system using a guided, diffuse discharge to release charge at a chosen point, prioritising a safe corona regime over arc formation. Thresholds were validated at altitude-equivalent pressure, with GNSS-disciplined timing synchronising the instrumentation logs. Control logic with interlocks was delivered; the system provides a non-destructive, reconfigurable dissipation path.

Localised plasma-assisted thin-film deposition

Thin-film deposition with localised plasma, precise, and repeatable.

What the client needed. A materials team wanted thin films deposited on selected regions of a 3D part without masking or vacuum.

How we delivered it. We built a localised plasma brush guiding a low-power discharge to a target point, enabling on-demand deposition and surface modification along programmed, CNC-style motion paths. Deposition rate and uniformity were characterised, and Python and C++ control software was delivered. The approach removed masking and vacuum chambers for selected coatings.

Voice & telephony

Reservation line for a restaurant group

A restaurant group's reservations handled around the clock.

What the client needed. A multi-location restaurant group wanted 24/7 phone intake for reservations, hours and menu questions, with VIP and private-event requests routed to staff.

How we delivered it. We deployed an AI receptionist on a SIP/VoIP stack with a per-location knowledge base and a structured booking flow (name, party size, date and time, confirmation). Price and private-event questions routed to a manager, callers transferred to staff by SIP REFER, and every call recorded with consent, transcribed by an open-weight speech model and emailed to the venue team.

Medical clinic intake and appointment line

A clinic's intake and appointments handled by phone, without the admin load.

The requirement they brought. A clinic needed appointment booking, opening-hours answers and intake triage with clinical questions handed to staff.

The engineering behind it. We delivered an appointment and intake flow over SIP telephony with hard guardrails against medical advice. Clinical matters transferred to staff; the system captured name, contact and reason per booking. Recording disclosure and data retention were configured to the clinic's privacy obligations.

Hotel after-hours call handling

After-hours calls answered, so the hotel never misses a guest.

Where it started. A boutique hotel needed reliable after-hours answering for availability, directions, amenities and callbacks.

What we built. We configured a 24/7 receptionist on a SIP trunk answering from a hotel-specific knowledge base, capturing callback details and transferring to the front desk in opening hours. Multilingual speech recognition covered English, Spanish and French callers, with a labelled transcript and recording for the duty manager on every call.

Legal firm lead qualification line

Every call qualified before it reaches a lawyer's desk.

What the client needed. A law firm wanted inbound callers screened and qualified before a lawyer callback.

How we delivered it. We built a qualification flow capturing practice area, name, contact and a short summary, with a hard rule against legal advice. Automated speech recognition and intent classification screened every inbound caller before a lawyer callback. Qualified leads were scheduled for callback and the transcript emailed to the intake team, cutting time spent on unqualified calls.

2011 → today

The year-by-year delivery record.

Every era, every place, every project: from the founding HFTRS surveys in Edmonton to about a hundred engagements a year. Chronological, geographic, with the technical ladder of each period.

Have a similar problem?

Tell us what you need shipped. You get a straight answer within one business day.