Skip to content
DevOps · MLOps · Terraform · EU‑controlled

Get your AI and platform work through review and into production

Senior engineering for DACH/EU B2B teams, on AI and non-AI workloads alike. In 10 business days, our assessment gives your security, procurement, finance and data protection reviewers the evidence they ask for. Your engineers get a 90-day ranked backlog, on infrastructure you control in the EU.

You talk to the engineer who does the work.

What a reviewed stack reports

SBOM (SOFTWARE BILL OF MATERIALS)SIGNED AUDIT LOGCOMPLETE COST TAGSATTRIBUTED IAC (INFRASTRUCTURE AS CODE) DRIFTZERO ROLLBACK PATHREHEARSED EU REGIONPINNED KEYSCUSTOMER-HELD P95 LATENCYTRACED SYSTEM INVENTORYFILLED EXIT PLANDOCUMENTED
DevOps
MLOps
Terraform
LLMOps
DataOps
EU-controlled

From €4,500 · 10 business days

Fixed price per agreed scope · Free 30-minute fit call · No obligation to book the build

Deployment path

Ready

Developer experience

In audit

Governance

Aligned

Cloud economics

Tagged

The demo passed. Your reviewers still have questions.

Before anything goes live, security, procurement, finance, data protection and now compliance ask for evidence. If one of them cannot get an answer, release slips a quarter, AI workload or not. We produce that evidence as a by-product of good engineering: technical evidence, not legal advice.

Review gates: security review, procurement questionnaire, finance and cost attribution, compliance evidence for NIS2 (Network and Information Security Directive 2), DORA (Digital Operational Resilience Act) and the EU AI Act, then production. Each gate holds the release on a named blocker until an artefact is attached. Technical evidence, not legal advice.
  1. Release candidate: AI or platform work

  2. Security review. Blocker: No rollback path, monitoring, or owner. Evidence that clears it: SBOM (software bill of materials), signed images, IaC (infrastructure as code) baseline.

  3. Procurement questionnaire. Blocker: No audit trail or service-level objectives (SLOs). Evidence that clears it: Audit log, SLOs, system inventory.

  4. Finance / cost attribution. Blocker: GPU and LLM spend unattributed. Evidence that clears it: Cost tags per tenant and product.

  5. Compliance evidence: NIS2, DORA, AI Act. Blocker: Technical documentation missing. Evidence that clears it: System inventory, evidence inventory.

  6. Production. Blocker: Release held until the evidence is on file. Evidence that clears it: Evidence pack on file, promoted by GitOps.

  1. Security review: no rollback path, no monitoring, no signed builds, no named owner. Release waits until that evidence exists.

  2. Procurement: the customer questionnaire asks for audit trails, service-level objectives (SLOs) and supplier facts. The system works; the evidence pack does not exist.

  3. Finance: GPU and large language model (LLM) spend cannot be traced to products or tenants, so every budget review ends with 'come back with numbers'.

  4. Data protection: the data protection officer (DPO) asks where data is processed, who holds the keys, and which data an answer came from. Nobody can show it.

  5. Compliance evidence: NIS2 (Network and Information Security Directive 2), DORA (Digital Operational Resilience Act) or the EU AI Act asks for a system inventory, logging and documented measures. The team has slides, not evidence.

  6. Delivery and ownership: deploys are manual, environments drift, and platform, data and model work is split across teams. Every review gate adds weeks nobody planned for.

Three practices on one foundation

A governed Terraform foundation, DevOps & automation, and MLOps & LLMOps on top. Each one leaves the evidence reviewers ask for behind: signed builds, audit logs, cost tags, an infrastructure-as-code (IaC) baseline and a system inventory. All of it on infrastructure you control in the EU.

Workloads

Control plane

Evidence

What we deliver at Terraform foundation

Governed Terraform foundation: Infrastructure as reviewed, tested code

  • Reusable modules, private registries, remote state with locking
  • Policy-as-code and drift detection in CI
  • Sovereign-ready landing zones with a documented exit
One system carries the model, the money and the evidence. Select a node to see what we deliver there.

Infrastructure as reviewed, tested code

Governed Terraform foundation

Terraform and OpenTofu modules built like product code, for any workload on EU regions of AWS, Azure, or GCP, or on a sovereign cloud. We add policy-as-code with Open Policy Agent (OPA), Sentinel, or Checkov, and drift detection. Pipelines stay safe when AI agents open pull requests: plan review, tests, and policy gates before apply. Sovereign-ready landing zones ship with a documented exit. We also migrate Terraform to OpenTofu.

  • Reusable modules, private registries, remote state with locking
  • Policy-as-code and drift detection in CI
  • Sovereign-ready landing zones with a documented exit

Frequent, reversible releases for every workload

DevOps & automation

Release engineering for web platforms, SaaS backends, data platforms, and AI workloads alike. We build CI/CD with progressive delivery and automated rollback, GitOps promotion, and container and Kubernetes platforms. Every build is tested, scanned, and signed in the pipeline, so the security review gets evidence, not a promise.

  • CI/CD and GitOps for apps, data, and models
  • Progressive delivery with automated rollback
  • Delivery metrics baseline: deploy frequency, lead time, change-failure rate, time to restore

Models, prompts, and agents that ship like software

MLOps & LLMOps

Training pipelines, a model registry, evaluation gates, and promotion workflows for classic ML. For large language models (LLMs): a gateway with routing, budgets, and per-tenant cost tags, prompt and tool registries, and evals in CI. Every model, prompt, and agent reaches production through the same reviewed path and is monitored once live.

  • Model registry with eval and promotion gates
  • LLM gateway with budgets, cost tags, and audit logging
  • Drift, quality, and cost monitoring in production

Supporting capabilities

  • One platform for every LLM call: a gateway with guardrails, audit logging, and cost control. Routed to EU-hosted APIs, or to self-hosted open-weight models (vLLM or equivalent) where residency or model control demands it. Keys you hold, open components, and one infrastructure-as-code pattern for EU regions, sovereign clouds, or bare metal.

  • The AI layer on top of your Terraform foundation, inside the EU boundary: isolated accounts for model workloads. GPU quotas and node pools with guardrails, and private networking and workload identity for model endpoints. We add data-access boundaries for training and RAG, and inference logging sinks, so security can sign off before models touch production data.

  • Ingestion, dbt transformations, orchestration, and streaming, with data contracts, quality gates in CI, lineage, and freshness alerts. Training inputs, RAG corpora, and features become versioned, tested, and reproducible on the stack you already run. A reviewer can trace which data fed an answer.

  • Golden paths, self-service and preview environments, and observability developers actually use, so shipping a feature does not need a platform engineer on every ticket.

  • GPU and inference cost attribution per product and tenant, model routing, budgets and alerts. Cost-control levers designed into the architecture instead of chased in month-end reports.

  • A 10-business-day review of risk, cost leaks, data and delivery gaps, DevEx and reviewer evidence. It ends in a go / fix-first / pause verdict and a 90-day ranked backlog.

  • Audit logging, access controls, a system inventory and documented measures. They map to what NIS2, DORA and EU AI Act reviewers ask for, and to security questionnaires.

  • See offers and prices

The evidence pipeline

Evidence is a by-product of the pipeline, not a document sprint

Every commit runs through tests, scans and signing, a policy-checked Terraform apply, and a runtime that logs, meters and tags cost. What falls out is what security, procurement, NIS2 (Network and Information Security Directive 2), DORA (Digital Operational Resilience Act) and AI Act reviewers ask for.

Commit, then CI with tests, scan, SBOM (software bill of materials) and signing, then Terraform apply with policy check and drift detection, then runtime logs, metrics and cost tags. Each step fills the evidence packs for security review, procurement, NIS2 (Network and Information Security Directive 2), DORA (Digital Operational Resilience Act) and the EU AI Act. Technical evidence, not legal advice.

Infrastructure you control

EU-controlled by default

Your workloads run inside an EU boundary, with keys you hold, open components you can replace, and an exit you can execute. Sovereign clouds are options we build on, not partnerships we sell.

  • EU region boundaryWorkloads, data, and logs stay inside EU regions or a sovereign cloud. The boundary is defined in Terraform, so a reviewer can read it.
  • Keys you holdBring-your-own-key encryption and workload identity. Access is granted in code, logged, and revocable by you.
  • Open componentsTerraform/OpenTofu, Kubernetes, open gateways, and open-weight models where they fit. No component you cannot replace.
  • Documented exitInfrastructure as code, exported data, and a written exit plan. Leaving a provider is a project, not a crisis.

Code lives in your repositories from day one.

Your workloads, keys and open components sit inside an EU region boundary, with a documented exit route out of it.
  • EU regions of AWS, Azure, and GCP
  • AWS European Sovereign Cloud
  • STACKIT
  • IONOS
  • Open Telekom Cloud
  • Bare-metal GPU hosts

Deployment options we build on, chosen with you. Not partnerships, not endorsements.

Assess. Build. Operate.

Start with an assessment that gives you the straight answer and the evidence inventory. Build with a Production Implementation Sprint (one workload through review in 4–6 weeks) or the Private LLM Platform Package (an EU-controlled LLM platform). Add the Platform Operations Retainer only if usage and regulation demand it. Scope and price are agreed before kickoff.

Assess

Production AI Stack AssessmentFrom €4,50010 business days

Build, pick one

Production Implementation SprintFrom €18,0004–6 weeks

or

Private LLM Platform PackageFrom €24,0006–8 weeks
Full assessment fee credited toward your build

Operate

Platform Operations RetainerFrom €6,000/monthMonthlyoptional
Start here10 business days

Production AI Stack Assessment: Standard

From €4,500

One product team, one primary workload (AI or not), and a security, procurement or compliance review coming up next quarter

  • 6-dimension maturity heatmap, scored 1–5 with the evidence behind each score
  • EU AI Act system inventory + evidence inventory: what reviewers will ask for, and what is missing
  • FinOps opportunity register: where GPU and LLM spend goes, and what to cut first
  • Data & delivery review: pipelines, contracts, continuous integration and delivery (CI/CD), rollback
  • DevEx scorecard and a 90-day ranked backlog, infrastructure as code (IaC) and automation first
  • The straight answer: go, fix-first, or pause
12–15 business days

Production AI Stack Assessment: Regulated

From €8,500

Multiple teams, high-risk use cases (EU AI Act Annex III), or an active procurement, NIS2, DORA or regulator review

  • Everything in Standard
  • Multi-team interviews
  • Provider vs deployer role mapping for every system
  • AI agent and Model Context Protocol (MCP) readiness, with a tool-auth review
  • Deep automation & IaC drift assessment across environments
  • Board-ready executive readout for procurement and regulator conversations

Which assessment fits your scope?

Four answers, matched to the published tier criteria.

Teams involved
AI workloads in scope
High-risk use case (EU AI Act Annex III)
Procurement or regulator review

Recommended

Standard

From €4,500 · 10 business days

Fits one product team, one primary workload (AI or not), and a security, procurement or compliance review coming up next quarter.

Full assessment fee credited toward your build

Book a Production Implementation Sprint or the Private LLM Platform Package within 90 days and we credit 100% of the assessment fee.

After the assessment

  • Production Implementation Sprint

    From €18,000 · 4–6 weeks

    One workload through review and into production in 4–6 weeks, not two quarters, in code your team owns. Landing-zone modules, CI/CD with rollback and signed builds, data quality checks, observability and cost tags. An LLM gateway with eval gates where a model is involved. A focused build, not an open-ended platform programme.

    Request sprint scope
  • Private LLM Platform Package

    From €24,000 · 6–8 weeks

    An EU-controlled LLM platform: gateway, guardrails, audit logging and cost control. Routed to EU-hosted APIs, or to self-hosted open-weight models when residency or model control demands it. Retrieval-augmented generation (RAG) with evals in CI, and a full LLMOps lifecycle on infrastructure you control. Not a SaaS API wrapper project, and not a vague LLMOps retainer.

    Request private LLM scope
  • Platform Operations Retainer

    From €6,000/month · Monthly

    Keep the evidence current as usage and regulation grow. Monthly platform and architecture reviews, FinOps governance, reliability work, and upkeep of the inventory, logs and documentation your reviewers ask for. Optional, never required to start.

    Discuss retainer

What lands on your desk in 10 business days

Fixed scope, board-readable outputs, and an engineering backlog your team can execute in Terraform, CI/CD, GitOps and your data pipelines. Or we run the build for you. Every artefact is written to be forwarded to a reviewer.

Assessment clock: Standard

  1. Days 1–2Discovery & system inventory

  2. Days 3–5Production & automation assessment

  3. Days 6–8Risk & evidence mapping

  4. Days 9–10Delivery & readout

Lands on day 10

  • Executive readout (10–15 slides)
  • 6-dimension maturity heatmap
  • EU AI Act system inventory (filled)
  • Evidence inventory for security, procurement, NIS2, DORA, and EU AI Act reviews
  • DevOps, IaC & DevSecOps gap analysis
  • Data pipeline findings (contracts, lineage, freshness)
  • FinOps opportunity register
  • DevEx scorecard
  • 90-day ranked backlog with effort bands

The system inventory and evidence gap analysis are engineering artefacts. Legal classification, NIS2 and DORA scoping, and regulatory submissions stay with your counsel.

Regulated adds (from €8,500, 12–15 business days):

  • Multi-team interviews
  • Provider vs deployer role mapping for every system
  • AI agent and Model Context Protocol (MCP) readiness, with a tool-auth review
  • Deep automation & IaC drift assessment across environments
  • Board-ready executive readout for procurement and regulator conversations

Illustrative sample, not client data · 1-5 maturity scale

Every assessment includes a scored heatmap across six production dimensions.

  • Data & pipelines3/5

    Quality, lineage, data contracts, feature stores, and reproducible training inputs.

  • Deploy & automation2/5

    CI/CD, IaC, GitOps, rollback, environment parity, and delivery metrics.

  • LLM & agents2/5

    Gateways, eval gates, prompt versioning, tool auth, RAG quality.

  • FinOps2/5

    GPU and inference attribution, routing, and budget guardrails.

  • DevEx3/5

    Golden paths, inner-loop speed, observability, on-call readiness.

  • Governance2/5

    Logging, access, documentation, NIS2, DORA and EU AI Act technical evidence.

Start before you book

EU AI Act system inventory template

Download the EU AI Act inventory template

For your reviewers

What each reviewer receives from an engagement

Four cards, one per reviewer, listing the artefacts they get and what each one answers. Forward the card to the person who has to sign off.

Can this be rolled back, monitored, and traced?

Receives

  • DevOps, IaC & DevSecOps gap analysis: CI/CD, GitOps, drift, secrets, rollback, pipeline security
  • 6-dimension maturity heatmap with the evidence behind each score
  • Reliability risks: service-level objectives (SLOs), incident response, on-call readiness
  • 90-day ranked backlog with IaC, CI/CD and GitOps items first, with effort bands

Forward this to your CISO or information security officer.

Where is data processed, who holds the keys, and which data fed an answer?

Receives

  • EU AI Act system inventory: models, agents, pipelines, vendors, and where each runs
  • Environment map (dev, staging, production) with IaC coverage noted
  • Data pipeline findings: contracts, lineage, freshness
  • A data processing agreement (DPA) where we process personal data on your behalf

Forward this to your DPO.

What does this cost per product and tenant, and what is the engagement price?

Receives

  • FinOps opportunity register with estimated impact
  • FinOps scan: GPU, inference, and cloud attribution gaps by product and tenant
  • Fixed price per agreed scope, known before kickoff; assessment fee credited toward a build within 90 days

Forward this to your CFO or controller.

Who is the supplier, and what fills the questionnaire?

Receives

  • Supplier facts: legal entity, register court and number, address, from our Impressum
  • Evidence inventory: what security and procurement will ask, and what is missing
  • Executive readout (10–15 slides), board-readable
  • Code and documentation in your repositories from day one

Forward this to procurement.

How we deliver

  • Everything as code

    Terraform, Pulumi, GitOps, and CI/CD. Production changes are codified, reviewed, and repeatable, for AI and non-AI workloads alike.

  • EU AI Act evidence

    System inventory, logging, and the technical evidence NIS2, DORA and EU AI Act reviewers ask for.

  • FinOps by default

    GPU and inference spend treated as financial architecture, not surprises.

  • EU-controlled infrastructure

    EU regions or sovereign clouds, keys you hold, open components, and a documented exit. Shaped for Mittelstand software teams and regulated B2B.

From first call to a system your team can run

Fixed-scope entry, engineering delivery, optional operate. No open-ended statement of work (SOW) trap.

  1. 01

    30-minute fit call

    Free, with an agenda. We confirm your stack, the review that is blocking you, and whether a fixed offer is the right next step. If it is not, we say so.

  2. 02

    Production AI Stack Assessment

    10 business days (12–15 for Regulated). Interviews and a system walkthrough, then the straight answer: go, fix-first or pause. With it: your 6-dimension maturity heatmap, FinOps opportunity register, evidence inventory, and 90-day ranked backlog.

  3. 03

    Production build

    A Production Implementation Sprint (one workload through review in 4–6 weeks) or the Private LLM Platform Package (an EU-controlled LLM platform in 6–8 weeks). Fixed price per agreed scope. Code lives in your repositories from day one.

  4. 04

    Operate & improve

    Optional Platform Operations Retainer: keep the evidence current as usage and regulation grow. Platform reviews, FinOps governance, and reliability hardening.

Developer experience

When deploying is harder than building, releases stall

We score your inner loop and delivery flow: environments, golden paths, observability, ownership, deploy frequency, time to restore. Then we fix the bottlenecks so your team ships weekly, not quarterly.

DevEx is scored in every assessment
  • Golden paths

    Documented, supported workflows for building, deploying, and debugging services and models. Not tribal knowledge in Slack.

  • Inner-loop speed

    Local dev parity, preview environments, and fast feedback loops for engineers shipping features, AI or not.

  • Observable by default

    Dashboards, alerts, and traces that answer what broke, for whom, and what it cost without a war room.

  • Ownership & runbooks

    Clear on-call boundaries, rollback playbooks, and handover docs so production is boring in the best way.

Typical assessment findings

  • No staging parity for GPU workloads
  • Manual deploy runbooks
  • Missing cost tags on inference
  • On-call without model rollback paths
  • Eval suites only run locally
Book stack assessment

Check your own stack in two minutes

Rate your production readiness, or compare your delivery with the DORA clusters (DevOps Research and Assessment, not the EU Digital Operational Resilience Act). You can also step through a sample Terraform run with drift and a policy gate. Nothing you enter leaves this page.

Rate each dimension from 1 (not in place) to 5 (measured and owned). These are the six dimensions every assessment scores.

Data & pipelines
Deploy & automation
LLM & agents
FinOps
DevEx
Governance
Data &pipelines3Deploy &automation3LLM &agents3FinOps3DevEx3Governance3

Partly codified

average 3.0 / 5

Most pieces exist, but few are codified or measured, so every review means assembling evidence by hand.

All six rated 3/5. Move a few to see where the gaps are.

Average 3.0 of 5. Partly codified.

Self-rated, and nothing you enter leaves this page. The assessment replaces these numbers with scores backed by evidence.

Pick the range that fits your primary service over the last few months. Answers are matched to the four delivery performance clusters DORA published.

Medium cluster: between once per week and once per month

Medium cluster: between one week and one month

Medium cluster: 10%

Medium cluster: less than one day

LowMediumHighElite

Nearest profile: Medium

35% of 2024 survey respondents fell in this cluster.

Our DevOps and automation work moves these four keys directly:

  • CI/CD and GitOps for apps, data, and models
  • Progressive delivery with automated rollback
  • Delivery metrics baseline: deploy frequency, lead time, change-failure rate, time to restore
See DevOps & automation

Nearest DORA 2024 cluster: Medium.

Book stack assessment

DevEx is scored in every assessment

Cluster values from DORA, Accelerate State of DevOps Report 2024 (p. 13). We match your answers to the nearest published cluster profile; ties go to the lower cluster. Clusters describe survey responses, not targets.

A sample landing-zone module (accounts, network, identity, logging, tags). Someone changed a security group in the console, and a policy gate blocks untagged audit logs. Step through it.

  1. 1Plan the landing zone, not run
  2. 2Check policy as code, not run
  3. 3Fix the tags in code, not run
  4. 4Re-plan and re-check, not run
  5. 5Apply, not run

Ready. Run the first step.

idlelanding-zone / sample output
$ terraform plan -out=tfplanmodule.network.aws_vpc.ai_workloads: Refreshing state... [id=vpc-0example]module.network.aws_security_group.inference: Refreshing state... [id=sg-0example] # Sample run, paused. Press "Run step 1" to see the plan and the drift it finds.

Illustrative sample module. Resource names, IDs, and output are abridged and not taken from any client environment.

Production AI Radar

Know what to adopt, trial, or avoid before you bet the roadmap

Each signal includes production risk, EU context, effort estimates, and how-to guides. Explore the radar or get your stack scored in the assessment.

Explore radar, tools & guides
Adopt

Proven in production – implement on your next release cycle.

Trial

Ready for controlled pilots with clear success metrics.

Assess

Worth evaluating – not yet default for every mid-market stack.

Caution

High risk without guardrails – avoid or constrain heavily.

Questions before you book

Price, scope, what we need from your team, what EU-controlled means, and where NIS2, DORA and the EU AI Act fit. Answered upfront so you can decide fast.

  • We reply within one business day: times for a fit call, or availability for an assessment. You talk to the engineer who does the work. We confirm your stack and the blocker, agree scope, the access list and anything we should not see, and fix the price before kickoff. Sending the form does not commit you to anything, and if no fixed offer fits, we say so.

Next step

Get the straight answer and your evidence inventory in 10 business days

Fixed price per agreed scope, from €4,500, ending in an honest go / fix-first / pause verdict and a 90-day ranked backlog. Book a Production Implementation Sprint or the Private LLM Platform Package within 90 days and we credit 100% of the assessment fee.

Assessment deliverables

  • 6-dimension maturity heatmap
  • FinOps opportunity register
  • EU AI Act system inventory
  • Evidence inventory for security, procurement and compliance reviews
  • DevEx scorecard
  • Data & delivery findings
  • 90-day ranked backlog (IaC & automation first)
  • Executive readout

You talk to the engineer who does the work.