Fast-moving, properly engineered, grounded in operations.
Enough structure to ship something good — not so much that you spend months in discovery before anything moves.
Six phases, one short loop.
Most engagements cycle through these phases more than once. The first pass is always the fastest — later passes extend and refine.
Discover
We spend time on the actual workflow — people, tools, handoffs, failure points. Interviews, shadowing and a clear write-up of the real process, not the idealised one.
Design
We map the target architecture and the user experience: where data lives, how it moves, who sees what, and how the system fails safely.
Prototype
A real proof in days. Working screens, real data flow, enough to show the shape of the solution and generate strong opinions.
Build
Proper engineering. TypeScript, modern frameworks, identity-aware APIs, observability and deployment pipelines from the first commit.
Deploy
Launch into a supported environment with security, identity, access control, monitoring and support plans in place.
Improve
Measure how it's used. Iterate on friction. Extend where the value is. Decommission what isn't earning its keep.
“A working prototype beats a polished document every time.”
How we think about the work.
Operational depth over demo flash
We care about identity, permissions, deployment and support — not just how it looks on day one.
Ship something real quickly
A working prototype beats a polished document every time. We aim to put something in front of users early.
Plain language, always
Architecture and trade-offs explained in the language your team actually uses, not consultant-ese.
Hand over clean code
You own what we build. Readable, documented, deployable — not locked to us.
How we ship software safely.
Engagement shape is one half of the story. The other half is the engineering practice underneath — threat modelling before code, continuous scanning with Aikido, optional independent QA and pen testing by Zoonou, and hosting on our own Nutanix / Fortinet platform.
The assurance practice behind every AI rollout we deliver.
Every engagement sits on top of a certified parent practice — independently assessed for security, quality, environmental and cyber-risk — and available to buy through G-Cloud, TePAS2 and other public-sector frameworks.
- / Information security
ISO 27001
Data classification, access control, audit trails and incident response applied to every system we ship. The scaffolding that makes “where does the data go?” a question with a clear, defensible answer — not a shrug.
- / Quality management
ISO 9001
Change control, documented acceptance criteria and version history applied to AI and automation work. What turns a weekend proof-of-concept into a production system you can still reason about six months in.
- / Environmental management
ISO 14001
Model selection, hosting and hardware decisions weighed against energy, lifecycle and supplier impact. The quiet discipline behind not running a frontier model for a task a smaller one handles just as well.
- / Baseline cyber hygiene
Cyber Essentials Plus
Independently tested controls — patching, configuration, identity, malware protection — verified annually rather than self-asserted. The floor every AI rollout sits on, not a certificate we printed ourselves.
- / MSP trustmark programme
Assurix
In progressA live assurance programme aligned to NCSC CAF 4.0 — privileged access, supplier risk, monitoring, incident response. Verified evidence, continuously re-checked, for the controls AI and automation rollouts depend on.
- / Secure development & hosting
Continuous assurance
Every codebase — ours and the software we host for customers — runs under Aikido for continuous code, dependency and container scanning. Hosted systems are kept on current framework and library versions and subject to continuous penetration testing. The control loop that turns “secure at go-live” into “secure six quarters in.”
Available through public-sector frameworks.
Your procurement team can call off against an existing Crown Commercial Service contract rather than run a fresh tender.
What you own. What we run.
An MIP engagement is two halves. The IP and the assets are yours. The ongoing operation is ours. Both are written into the engagement letter, in plain English.
The IP and the assets.
- Source code, in your repository or ours, transferable on request.
- The database, the schema and the data inside it.
- Trained-model artefacts and prompt configurations where they apply.
- The architecture and the documentation, written for handover from day one.
- Any third-party licences, in your name, on your bill.
No vendor lock-in. If we part ways, you walk out with everything you need to keep going.
The bits that need ongoing attention.
- Integrations and the data flows between your systems.
- Policy enforcement, change watch and monthly evidence.
- Model upgrades, vendor swaps, deprecation handling.
- Observability, alerting and the on-call when something drifts.
- The rails — security, identity, audit — kept current.
The Managed Intelligence half of the offer. Not a project that ends at go-live.
Let's talk about what you're trying to build.
Book a discovery session and we'll walk through the workflow, the systems and the shape of the solution.