Data solutions

Warehouses, pipelines and reporting people actually use. Most of our data work starts with someone who doesn't trust a number on a dashboard.

• Data platform builds on Snowflake, BigQuery, Databricks or plain Postgres
• Pipelines with dbt and Airflow — tested, monitored, and documented
• Migrations off legacy warehouses, Access databases and spreadsheet sprawl
• Governance: lineage, cataloguing, access control and GDPR-defensible retention
• Reporting layers in Power BI, Looker or Metabase that agree with each other

Typical start: a two-week audit of your current data estate, ending in a written plan you own.

AI

Models in production, not slide decks. Half of this work is deciding which ideas deserve a build — and saying so early.

• Feasibility reviews that end in a yes or a no, with the reasoning attached
• Retrieval assistants over your own documents, with citations and access rules
• Forecasting, classification and document extraction on your existing data
• Evaluation harnesses, so you find out it's drifting before your customers do
• Guardrails, cost controls and an AI use policy your risk team can sign

Typical start: one use case, proven or ruled out in six weeks.

DevOps

Ship on a Tuesday afternoon without holding your breath. If releases only happen at midnight on a Friday, this is the arm you need.

• CI/CD pipelines in GitHub Actions, GitLab CI or Azure DevOps
• Infrastructure as code with Terraform — reviewable, repeatable, no console clicking
• Containers and Kubernetes, sized to what you actually run
• Observability: logs, metrics, traces and alerts that someone will act on
• Cloud cost reviews on AWS, Azure and GCP

Typical start: a delivery review — commit to production, timed and mapped.

Cyber security

Find the gap before someone else finds it. Then close it, and prove it stayed closed.

• Security posture reviews against Cyber Essentials and ISO 27001
• Penetration testing and a vulnerability process that survives the report
• Identity and access: SSO, MFA, least privilege, joiner-mover-leaver
• Cloud security posture and secrets management
• Incident response plans and tabletop exercises with your actual leadership team

Typical start: an external attack-surface review — what the internet can already see.

Testing & QA

Manual, automated and performance testing. It's the ring rather than an arm because it belongs to all four — a pipeline, a model, a deployment and a firewall rule all fail the same way: quietly, in production.

• Test strategy — what to automate, what to keep manual, and what isn't worth testing at all
• Automated suites from unit to end-to-end (Playwright, Cypress, pytest), running in your pipeline
• Exploratory and manual testing, plus UAT run with your actual users
• Performance and load testing with k6, JMeter or Gatling — against targets agreed before the run
• Accessibility testing against WCAG 2.2 AA, which for public sector work isn't optional
• Regression packs written down and handed over, so releases stop being an act of faith

Typical start: a test strategy review — what's covered, what isn't, and what's failing quietly.