How we build, ship and run AI.

Each project in its own box

Every production project has its own folder, its own network and its own database container. A database is never on a shared network, so one client's application cannot reach another client's data. Branch previews live on a separate network that cannot reach any database or the platform itself.

From the internet, only the web gateway (with TLS) and key-only SSH answer. Brute-force attempts are banned automatically, secret files are readable by their service only, and security updates install themselves.

A backup is only real once it has been restored

Every production database is dumped every night and copied off the server. Every week an automatic job restores those dumps into throwaway containers and compares them with the live data; a failed restore raises an alert like any outage. Our rule is simple: a project without a tested restore is not in production.

One verdict, and alerts that mean something

Every scheduled job reports each run, so a job that silently stopped shows up as overdue rather than as nothing. Projects, containers, disk and the WhatsApp numbers roll up into one verdict, and alerts fire when a state changes — not every minute. An external uptime check watches from outside our own infrastructure, so something still speaks if a server goes down.

AI writes on a branch; a person merges

Our team works with Claude connected to our operating system: it reads the projects, proposes code on the person's own branch and opens the pull request. It never merges on its own, and every call it makes is logged. The same discipline — a model that proposes, a human who decides — is how we design the AI agents we build for clients.