Regulated, audited, and unforgiving of downtime. Every change needs evidence.
You answer to a regulator and an auditor, and both want to see evidence rather than assurances. Availability targets are contractual, recovery objectives are written into agreements, and every production change has to be reconstructable months later by someone who was not there.
Dual-site database topology with a real quorum design, point-in-time recovery that has been restored and timed, and an access model an auditor can follow without a guided tour.
If two or three of these describe your environment, the audit is worth the money. If all four do, it is overdue.
Failover is documented as a procedure. The procedure has not been run against production traffic, so the real interruption time is unknown — and it is the number your contract is written against.
The job reports green every night. Whether the data can be restored, and how long that takes, has never been established by actually doing it.
Privileged access is spread across local accounts, shared keys and jump hosts. Producing an access review means interviewing people rather than querying a system.
Who changed what, when, and how it was rolled back — recoverable for last month, not for last year.
Sequenced so that stopping after any phase leaves you better off rather than stranded mid-migration.
Measure failover and restore against production traffic during a controlled window, rather than reading them off the design document.
A measured RTO and RPO you can put in a contract, with the gap to the documented target stated plainly.
Map nodes to failure domains, then simulate losing the largest single domain. Where quorum does not survive it, introduce a witness outside the primary domain.
A cluster that loses the domain you claim to tolerate and keeps serving, demonstrated rather than asserted.
Replace shared credentials with individual access, centralise sudo logging, and give the break-glass account its own alerting.
An access review that is a query, not an interview — plus a documented break-glass path an auditor will accept.
Make drill reports, restore timings and change records a by-product of normal operations instead of a thing somebody assembles before an audit.
A quarterly evidence pack that takes an hour to produce because it was never not being produced.
Each discipline has its own page with the technology stack, the acceptance criteria and an explicit scope boundary.
The cluster that keeps your business alive. Planned failover in seconds, backups you have actually restored, and upgrades performed while the application keeps writing.
Patroni · pgBackRest · WAL-G · PgBouncerMost HA clusters have never actually failed over. We build them so the failover works, and then we prove it by pulling the plug.
Pacemaker 2.1 · Corosync 3 · pcs / crm shell · pcsd web UIThe layer that holds every other cluster type together: fleets that deploy the same way everywhere, DR that has been rehearsed, and security that produces evidence.
Karmada · Rancher Fleet · Argo CD ApplicationSet · Cluster APIRecovery tiers with a measured RTO, an off-site copy that cannot be encrypted by ransomware, and a restore drill the board can read.
Proxmox Backup Server (+ sync jobs) · Proxmox VE backup · Bacula / Bareos · Amanda14s · measured automatic failover under production load
Read the engagement → Financial technology · North America8s · measured automatic failover
Read the engagement → E-commerce · North America3 · nodes synchronous, single-node failure tolerated
Read the engagement →Every case in this library is a representative engagement, written from our delivery patterns and marked as such. We do not present unnamed work as a named customer.
These are the numbers we put in the delivery report. If we cannot measure it, we do not promise it.
Every vendor says yes to everything. Here is where our answer is no, or where someone else needs to be in the room. If this list looks wrong for your situation, tell us — we would rather argue about scope before the contract than after.
Regulatory interpretation and compliance sign-off
We implement controls and produce technical evidence. We are not your compliance auditor and we do not interpret your regulator for you.
PCI DSS assessment and QSA engagement
We build and document the controls your QSA will test. The assessment itself belongs to a qualified assessor.
Core banking, payment switch and trading platform application work
We provide the platform underneath. If the change needs application vendors, they need to be in the room and we will say so early.
Cluster design, build, hardening and on-call operations
This is the work. Including the drills that produce the evidence.
Yes, and we would rather. Your CAB, your maintenance windows, your approval chain. We will bring the rollback plan and the test evidence; we will not ask you to exempt us from your own controls.
We will document exactly what we access and why, and we will scope it down to what the work needs. We do not sign as a covered entity, and we say that here rather than in a negotiation.
Managed tiers carry contractual response targets — 16×5 on Business, 24×7 with a 15-minute target on Mission-Critical. The measured median first response is published on our status page rather than promised in a deck.
Thirty minutes, no slides. Bring the awkward constraint — that is usually the interesting part.