Payments platform made boring to deploy through GitOps and health-gated rollback
Under GitOps with health-gated rollback, MTTR fell from 4 hours to 22 minutes and run-rate cost fell 34 percent.
Capability · Epcotec
Cloud platforms rescued, deploys made routine.
AWS/Azure landing zones, Kubernetes and OpenShift operations, Terraform IaC, CI/CD and observability built for production. Delivered by named senior engineers, fixed scope, staging from week one.
Epcotec rescues struggling cloud platforms for Australian engineering teams: we audit the failure points, stabilise deployments and cut infrastructure spend. AWS and Azure architecture, Kubernetes, Terraform-managed infrastructure, CI/CD pipelines and observability, delivered by senior platform engineers on a fixed scope. Most rescue engagements start with a paid two-week audit and continue as staged fixes with weekly demos.
What we deliver
The platform scope.
Landing zones with Terraform infrastructure as code, reviewable and repeatable
Accounts and networks defined in modules with policy baselines, budget alarms and guardrails applied on day one so every new environment starts compliant.
Kubernetes platforms operated by GitOps with health-gated rollback on every release
Declarative manifests held in Git with sync and drift detection, so the cluster reconciles itself and a bad rollout rolls back on health signals without operator intervention.
CI/CD pipelines with policy and security gates at every stage
Build, test, scan and deploy stages wired into one pipeline so a change cannot reach production without passing checks, and provenance of every artefact stays auditable.
Observability across metrics, logs and traces with SLO dashboards built in
Instrumentation, alerting and error budgets shipped with the platform so on-call teams see user impact before customers do and page on symptoms rather than causes.
Cloud cost engineering and FinOps audits that hold after handover
Tagging, rightsizing, committed-use planning and a monthly review cadence, so savings are structural rather than a one-time cleanup that quietly reverts within a quarter.
OpenShift enterprise platforms with operators, quotas, routing and operator-grade runbooks
Cluster design, upgrades, multi-tenancy and image management for regulated estates, delivered with the documentation and rehearsal your platform team needs to run it afterwards.
Platform rescue for deployments that have stalled or grown fragile
We characterise the live estate, rebuild the Terraform and pipeline baseline, then bring delivery back to routine cadence with weekly demos and measured change failure rates.
Rough time estimate
Window: 3-8 weeks
Team: 1 platform eng + 1 devops
Complexity: M-L
Indicative only. A fixed price follows a free scope review.
Get a fixed quoteDelivery process
From landing zone to handover.
Characterisation of the live estate and a Terraform code baseline
We map the estate, evidence current drift and cost, and commit a Terraform baseline so every later change is a reviewed pull request rather than console surgery.
Landing zone build and pipeline construction with policy gates applied
Accounts, networks, pipelines and guardrails land first, so application teams arrive on infrastructure that is compliant, observable and already wired for deployment.
Migration and build waves delivered in increments with weekly demos
Workloads move or get built in sized waves, each demonstrated at a weekly checkpoint, with rollback rehearsed before anything is called complete.
FinOps and SLO tuning that runs against measured production baselines
Cost, scaling and alert thresholds are tuned against real traffic, and savings are written into the platform so they persist after we leave.
Handover to your team with 30 days of accompaniment included
Runbooks, dashboards and access transfer with a two-week shadowing window, then thirty days of on-call accompaniment while your team settles into ownership.
Benchmark deliveries
Track record in this lane.
Cloud migration of a stranded on-prem platform with zero data loss
Replay-in-staging proved every write before cutover, so the platform crossed with zero data loss and no extended outage despite a vendor having walked away.
FinOps companion audit that turned its findings into standing savings
A short audit covering tagging, rightsizing and committed-use moves delivered a 34 percent run-rate reduction that held through the following two quarters.
More evidence in the delivery history and the complete 756-engagement register.
Standards & compliance
Platforms hardened to national guidance.
Operations and deliverables conform to the cross-cutting standards below, and platforms run with encryption in transit and at rest, least-privilege access and documented data-residency options in both Australia and Canada.
ISO/IEC 27001-aligned information security management
Operations and deliverables run under a documented management system aligned with ISO/IEC 27001:2022. The controls shape scoping, review, change management and evidence capture on every engagement.
Australia: Governs every Australian engagement, including hosting decisions and data residency.
Canada: Governs every Canadian engagement, including hosting decisions and data residency.
ISO 9001-aligned quality management
Quality management aligned with ISO 9001 governs scoping, review gates, acceptance criteria and handover, so every deliverable passes the same documented checks.
Australia: Applies to delivery for Australian clients across all service lines.
Canada: Applies to delivery for Canadian clients across all service lines.
Privacy Act 1988 and Australian Privacy Principles
Personal information handled in Australian engagements is processed in line with the Australian Privacy Principles, with access controls and data-handling rules carried through every environment.
Australia: Applies to all Australian engagements and to data processed on behalf of Australian clients.
PIPEDA and provincial privacy law
Personal information handled in Canadian engagements is processed in line with PIPEDA and applicable provincial law, including Quebec Law 25 where relevant.
Canada: Applies to all Canadian engagements, with Quebec Law 25 obligations observed where data or operations touch Quebec.
SOC 2-aligned controls
SOC 2-aligned controls are embedded in delivery: change management, access control, monitoring and evidence capture run on every engagement.
Australia: Evidence packs are available to Australian clients under NDA.
Canada: Evidence packs are available to Canadian clients under NDA.
Encryption and least-privilege access
Data is encrypted in transit and at rest, and access is granted least-privilege to named engineers with every change logged.
Australia: Australian data-residency options are available for Australian workloads.
Canada: In-Canada storage is available for protected data on Canadian workloads.
Essential Eight (ASD)
The Australian Signals Directorate’s Essential Eight mitigation strategies are implemented across Australian environments, with self-assessment evidence available to clients under NDA.
Australia: Applies to Australian environments and to Australian-stored client data.
References to standards describe alignment. Certification is claimed only where an accredited certificate is published on this page.
FAQ
What clients ask first.
What does the cloud platform engineering engagement include at a minimum?
Landing zones in Terraform, Kubernetes or OpenShift under GitOps, CI/CD with policy gates, observability with SLO dashboards, and a cost baseline you can audit.
Do you work on both AWS and Azure cloud platforms?
Yes, on both AWS and Azure, and on OpenShift where the estate demands it. Patterns stay consistent while account structure and managed services follow the provider.
What happens when a deployment fails under your GitOps setup?
Health probes gate the rollout, so a failing release is rolled back automatically and the cluster returns to its last known good state without operator intervention.
Can you take over an existing half-built or abandoned platform estate?
Yes. Characterisation comes first: we evidence what is running, rebuild the Terraform and pipeline baseline, then resume delivery on a routine cadence with weekly demos.