Infrastructure you can reason about
We design, build and run cloud platforms for engineering teams. AWS and GCP architecture, Kubernetes operations, Terraform, and the cost discipline that keeps all three sustainable.
A small senior team with no account layer. The person who reviews your architecture is the person who writes the Terraform.
Software we ship, and the bills we fix.
Cloud Certainty Secure Browser
Zero-trust remote browser isolation that runs entirely in your own AWS account. Every session is a disposable Chromium container, streamed to the user as encrypted pixels, with admin control over clipboard, files, printing and web access. $0.10 per session-hour on AWS Marketplace; close to nothing when idle.
Replacing Amazon WorkSpaces Secure Browser? It closes to new customers on 29 October 2026.
- 01One CloudFormation stack in your account and VPC
- 02Sign in with IAM Identity Center, SAML or OIDC
- 03No inbound access to sessions; destroyed when they end
- 04Clipboard, file, print, URL and timeout policies per group
Cloud Certainty Config Explorer
A desktop app that reads the AWS Config data you already deliver to S3 and turns it into an inventory you can filter and group any way you like, a map of how your resources relate, and a change log that tells real edits from noise. It runs on your machine; nothing is sent to us.
In early access for Windows. Tell us about your AWS setup and we will send you a build.
- 01Reads the AWS Config data already in your S3 bucket, read-only
- 02One account or a whole Control Tower organisation in one inventory
- 03Filter, group and pivot by any field, tag, rule result or relationship
- 04Relationships Config never records, inferred and labelled as such
Cloud Certainty BucketDeck
A web portal for Amazon S3 that runs entirely in your own AWS account. Your users browse, preview, search and move data across buckets and AWS accounts at scale, with per-user grants and an audit log, and no data leaves your account.
Four plans, from $100 a month, on AWS Marketplace.
- 01One CloudFormation stack in your own account and Region
- 02Browse, preview, search and move data across AWS accounts
- 03Per-user and per-group grants, down to the prefix on Team and above
- 04An audit log, and the user’s email in CloudTrail on every S3 call
Cloud Certainty FunctionPilot
A better AWS Lambda console that runs entirely in your own AWS account. Every function across your accounts and Regions in one table with metrics, a test workbench that keeps shared tests and their results, and logs that never ask for a log group, with per-team grants that AWS enforces.
In early access ahead of its AWS Marketplace launch. Tell us about your AWS setup and we will set you up.
- 01Every Lambda function across your accounts and Regions in one table, with metrics and the day each one last ran
- 02Saved tests without the console’s 10-event cap, with assertions, shared with your team, with run history
- 03Logs by function, never by log group, with a live tail across functions and errors grouped into an inbox
- 04Grants per user or group on function name patterns, enforced by AWS
Cloud Certainty SQLark
A better Amazon Athena console, with dashboards, that runs entirely in your own AWS account. A SQL workspace with autocomplete and the cost of every query, a history that records who ran what, shared queries with versions, and dashboards with variables and time macros, with per-user grants that AWS enforces.
In early access ahead of its AWS Marketplace launch. Tell us about your AWS setup and we will set you up.
- 01A SQL workspace with tabs, schema autocomplete, and the data scanned and cost of every query
- 02Query history with who ran each query, kept up to two years instead of Athena’s 45 days
- 03Charts and dashboards with variables, a time picker and partition macros, from plain SQL
- 04Grants per user or group on workgroups and databases, enforced by AWS and named in CloudTrail
Cloud Certainty TraceHound
A better Amazon CloudWatch Logs console that runs entirely in your own AWS account. What every log group stores and costs, with the never-expire and orphaned ones fixed in bulk, search with facets and patterns, one request traced across every service, and Live Tail shared by the whole team, with per-user grants on log groups that AWS enforces.
In early access ahead of its AWS Marketplace launch. Tell us about your AWS setup and we will set you up.
- 01Storage, growth and estimated cost of every log group, with never-expire, orphaned and noisy groups found and retention set in bulk
- 02Search with a histogram, facets and patterns, and Trace: one request id followed across every service on a timeline
- 03Live Tail shared between viewers, dashboards from a template gallery, and who ran which query and what it cost
- 04Grants per user or group on log group patterns, enforced by AWS and named in CloudTrail
Cloud Certainty Watchtower
A better AWS Security Hub console that runs entirely in your own AWS account. Instant search and facets across every account and Region, a fix list ranked by risk with Terraform and CloudFormation remediation, tasks with SLAs, exceptions that expire, and findings mapped to your code on GitHub, with per-account grants that CloudTrail traces to the person.
In early access ahead of its AWS Marketplace launch. Tell us about your AWS setup and we will set you up.
- 01Instant search, a query language and facets with counts across every account and Region, with triage written back to Security Hub
- 02A fix list ranked by risk, with Terraform, CloudFormation and CLI remediation for common controls
- 03Tasks with SLAs and progress measured from the findings, and exceptions that expire
- 04Findings mapped to your Terraform and CloudFormation on GitHub, with fix pull requests and Trivy, SonarCloud and SARIF correlated
Cloud Certainty StateCraft
A better AWS Step Functions console, with a visual and voice workflow designer, that runs entirely in your own AWS account. Every state machine across your accounts and Regions, every execution state by state with its timeline and full history, failures redriven in bulk, and a designer you can drive by voice, with per-user grants that AWS enforces.
In early access ahead of its AWS Marketplace launch. Tell us about your AWS setup and we will set you up.
- 01A workflow designer you can drive by voice: “add a Lambda task called Charge card after Validate order”
- 02An execution explorer with a live graph, a timeline of every retry and Map iteration, and the full history
- 03Search, compare, bulk stop and bulk redrive executions across state machines, accounts and Regions
- 04Grants per user or group on state machines, enforced by AWS and named in CloudTrail
Cloud Certainty Memora
The console for Amazon ElastiCache (Valkey, Redis OSS and Memcached) that runs entirely in your own AWS account. Every cache across your accounts and Regions with its cost and findings, full control of each one, and a key browser, a command workbench and memory analysis built for teams, with per-user grants on cache and key patterns and no cache passwords handed out.
In early access ahead of its AWS Marketplace launch. Tell us about your AWS setup and we will set you up.
- 01Every cache across accounts and Regions, with cost and findings: Extended Support charges, the Valkey saving, underused nodes
- 02A key browser, a command workbench and memory analysis for Valkey and Redis OSS, without passwords or a bastion
- 03Full control of each cache: backups, scaling, failover, parameter groups and the upgrade from Redis OSS to Valkey
- 04Grants per user or group on cache and key patterns, enforced by Memora, by AWS and by the cache’s own ACL
Your whole infrastructure bill, in one window
A desktop app for cloud cost management. It brings billing from every provider you run on into one view, then adds cost analysis, budgets, anomaly detection, forecasts and savings recommendations on top. It is the tool our own cost work runs on.
- 01AWS, Azure, Google Cloud, Hetzner Cloud and GitHub in one view
- 02Budgets, anomaly detection, forecasts and savings recommendations
- 03Runs on your machine; credentials and billing data never leave it
- 04Ask Claude about your bill through the Model Context Protocol