Portability & control
Yours to run. Anywhere.
Every application we build is designed to be able to leave. Portable by design, and able to run on your cloud or your own hardware when your business, your customers or your regulator require it. Software that can't move is a liability waiting to happen.
The promise
We build so you can move out — or move in.
Portability is a decision made on day one, not a clause added when someone finally asks. It shapes how we store data, how we write rules and which tools we are willing to depend on.
Portable by design
Ordinary, documented components. No private corners only one supplier understands.
Runs where you need it
Moved rather than rewritten: our management, your cloud, or a rack in your building.
Compliance designed in
Access control, audit records and retention are part of the build from the start.
What moves with you
Portability is only real if the useful parts can actually leave. These are the things we agree are yours before a line of code is written.
Your data
Exportable in an ordinary format, with the structure documented. Not stored in a shape only we can read.
The application
Source, configuration and deployment steps handed over. Another competent developer could pick it up.
The rules
Calculations, checks and thresholds are written down and tested, so the logic travels with the software.
The access model
Roles, permissions and audit records are defined openly, not buried inside someone else's account settings.
The AI layer
The model is a component, not the foundation. Change provider, or run a suitable model yourself where the task allows.
The branding
Your name, your colours, your address. Nothing that identifies us needs to stay in the finished product.
Where it can run
The same application, in the place your business actually needs it. Most projects start with us running it; some are built for a home that was decided before the first sketch.
Managed by us
The usual starting point. We host, update, back up and monitor the application while you use it.
Worth watching: You are trusting us to stay good — which is exactly why the exit stays open.
Your cloud account
The same application running in a subscription you own, in the region you choose, under access control you set.
Worth watching: You carry the cloud bill and some of the day-to-day administration.
Your own hardware
Installed on a server in your building, so the data never has to leave the site. Common where information is sensitive or connections are unreliable.
Worth watching: Power, resilience, hardware upkeep and support access all need planning before, not after.
A model you host
Where a suitable language model can meet the task, the AI work can run on equipment you control instead of an external token service.
Worth watching: Hardware, energy, model quality and support all cost money — and running locally does not make an application compliant by itself.
Compliance
A system designed to be compliant doesn't need heart surgery.
Technology moves faster than legislation. Rules arrive late, and then they arrive all at once — and the systems that were bolted together have to be taken apart. Building for the rules you already have, and leaving the evidence trail in place for the ones still coming, means a change in regulation costs you paperwork and a review. Not a rebuild.
The evidence a regulator asks for, already there
- Who did what, and when — recorded as the work happens, not reconstructed later.
- Records kept for the period your sector requires, then disposed of deliberately.
- Checks and approvals traceable to the person who made them.
- Where the data sits is known and changeable, not an accident of the hosting contract.
- AI involvement is labelled and reviewed, so a human decision is visible in the record.
- Changes are versioned and reversible, so an auditor can see what the system did at a given date.
Rules follow the technology. That isn't a loophole.
In August 2026 the EU's AI Act transparency duties came into force and enforcement began, while the Digital Omnibus (Regulation (EU) 2026/1744) moved obligations for high-risk systems from 2 August 2026 to 2 December 2027 — a deadline shifting after the technology had already shipped. Where those rules reach your business, or the larger organisations you sell to, the sensible response is a system whose behaviour can be shown, not one whose behaviour has to be discovered.
Sources: European Commission, 31 July 2026 · DAC Beachcroft on the AI Omnibus, 13 August 2026. Timelines for high-risk systems are still being amended; take your own advice on what applies to you.
What we won't claim
A promise about portability and compliance is only worth reading if the limits are printed on it too.
We don't certify compliance.
We can't tell you which rules apply to your sector, and a hosting decision is not a certificate. What we do is build so your own assessment, auditor or regulator can see exactly what the system does.
In-house is an option, not a default.
Running a model yourself suits some tasks and not others. We assess it against the work, the data and the total cost — including the parts people forget to price.
Portability takes more thought up front.
Documenting, exporting and testing the exit adds a little work at the start. That is the point: it is far cheaper than discovering it during an audit or a supplier change.
Mention your sector and any data-control requirement in the brief — it shapes the design, not the quote at the end.