Technology & architecture
The reference architecture
underneath the portfolio.
Five layers from probe to production change: collection, processing, analytics, agents and automation — with the security posture, integration surface and deployment options that make it viable inside a regulated estate.
Reference architecture
Five layers, deployed entirely inside your perimeter
Every platform in the portfolio is a specialisation of this stack. The payload changes; the shape does not.
Data & probe collection
Protocol-level acquisition from the network, infrastructure, applications and edge sensors — on-premises only, with no collector reaching outward.
AI-powered data processing
Kafka and Flink stream processing, feature engineering, and multi-tier storage across InfluxDB, Elasticsearch and Neo4j.
AI analytics & intelligence
LSTM, autoencoders, graph neural networks and isolation forests feeding a root-cause analysis engine and predictive failure detection.
Multi-LLM AI agents
Self-hosted Llama 3 and Mixtral-class agents specialised by domain, coordinated by a master orchestrator over an MCP-powered RAG pipeline.
IaC automation platform
Natural language translated to Terraform, Ansible and Kubernetes manifests, with GitOps, canary deployment and automatic rollback.
Layer 01 in detail
Collection: protocols, logs and on-demand tracing
Coverage is the point. A blind spot in collection becomes a blind spot in every layer above it.
SNMP v2c / v3
Device metrics and traps
NetFlow v9 / IPFIX
Traffic flow analysis
sFlow
Packet sampling
NETCONF / YANG
Configuration telemetry streaming
gRPC telemetry
Model-driven real-time data
OpenTelemetry
Traces, metrics and logs
Prometheus
Container monitoring
IPMI / JMX
Hardware and JVM health
Log collection
- Syslog RFC 5424 / 5425 over UDP, TCP and TLS
- File-based agents with log rotation handling
- Kubernetes and Docker container logs
- Windows Event Logs via WMI
- Database audit streams — PostgreSQL, MySQL, Oracle, MongoDB
On-demand tracing
- OpenTelemetry and Jaeger compatible
- Span correlation across microservices
- L3/L4 packet flow visualisation
- Adaptive sampling strategies
- APM code-level instrumentation
Layer 05 in detail
Speak the intent. The platform writes the infrastructure.
Natural language is translated into production-ready infrastructure code — then held behind the approval chain, drift detection and audit trail that make automation acceptable to a change board.
Example commands
- “Deploy the latest microservice to production with canary rollout”
- “Block all traffic from 10.5.0.0/16 due to an active security incident”
- “Scale up the web tier to handle the increased traffic load”
- “Roll back the database deployment to the previous stable version”
Terraform code generation
Provider-aware, reviewed as code, merged through the same pipeline as hand-written modules.
Ansible automation
Configuration and remediation playbooks generated from intent and validated before execution.
Kubernetes manifests
Workload, network policy and scaling definitions produced against the target cluster's conventions.
GitOps workflows
Declared state in version control, with reconciliation and a reviewable history of every change.
Canary & auto rollback
Progressive delivery with health gates and automatic reversion on breach.
Drift detection
Continuous comparison of infrastructure as code against actual state, with reconciliation proposals.
Multi-stage approvals
Role-based approval chains before any change reaches a protected environment.
RBAC + ABAC
Granular per-resource permissions, with attributes as well as roles governing what an agent may do.
Security & deployment
Complete in-house deployment — zero external services
Self-hosted models, private infrastructure, internal certificate authority and an air-gap option. The security posture is architectural rather than configurable.
Self-hosted AI models
LLMs, embedding models, inference services and classical ML all running on your own GPU infrastructure.
Private infrastructure stack
Orchestration, storage, databases and vector stores deployed and operated within your perimeter.
Air-gap option
Complete internet isolation for maximum security in environments where connectivity is itself the risk.
Private PKI & AES-256
An internal certificate authority for all TLS/SSL, with end-to-end AES-256 encryption in transit and at rest.
No data egress. Zero telemetry leaves the private network. Where a platform is multi-tenant, isolation is enforced by PostgreSQL row-level security at the database — a query issued without a tenant attached returns nothing at all, not everything.
Integrations & ecosystem
Connected to the toolchain you already run
Platforms that cannot reach the ticketing system, the identity provider and the deployment pipeline become another silo. Integration is scoped as a first-class deliverable.
ITSM & ticketing
- ServiceNow
- Jira Service Management
- PagerDuty
ChatOps platforms
- Slack
- Microsoft Teams
- Mattermost
CI/CD pipelines
- Jenkins
- GitLab CI
- GitHub Actions
Identity & SSO
- SAML 2.0 / OAuth 2.0
- Active Directory / LDAP
- Okta / Azure AD
BI & reporting
- Tableau
- Power BI
- Looker
Infrastructure
- Kubernetes / OpenShift
- VMware vSphere
- OpenStack / Proxmox
Stack
What we build with
Cloud & platform
Data & streaming
AI & models
Enterprise systems
Edge & sensing
Observability
Architecture review
Bring your current architecture.
We will mark it up honestly.
Where the blind spots are, what the integration surface really costs, and which layer to build first. An architecture review is usually the cheapest way to find out whether we are the right partner.