What we do · 02 · Technology & Intelligence
Websites, apps, custom software, AI agents and cloud, built securely and supported after launch.
An illustrative diagram of your platform in four layers: Experience (Websites & Apps, Search & AI Visibility); Intelligence (AI Strategy & Agents, AI Product & Automation); Platform & data (Custom Software & Data Platforms, AI Infrastructure & Cloud, Integration & Support); Trust & operations (Cybersecurity & AI Trust, Audits & Assessments, Tech Workforce). Requests move between the capabilities while a status bar shows 95th-percentile latency of 212 milliseconds, 148 of 148 evaluation cases passing, 71 percent of the error budget left and 0.18 grams of CO2e per request.
Why now
Four changes drive this: AI inside products, models that change every month, AI answers in search and stricter security and privacy law. Each card names a public source you can check.
These figures describe the market; none is a claim about our own results.
→In the product Then: A pilot. Now: In the product.
LLM01
Prompt injection, first on the list
AI features and agents now sit in customer journeys, where they fail in ways ordinary testing does not catch.
What we do about it
We test AI features on your own examples, add automatic checks and have a named person approve each release.
04AI Product›Source · OWASP Top 10 for LLM Applications, 2025
→1M+ tokens Then: ~4k tokens. Now: 1M+ tokens.
1M+
Tokens of context, up from about 4k
Context limits, prices and rankings move faster than release plans, so testing must run on every change.
What we do about it
We call every model through one gateway, so switching model needs no rebuild.
03AI Strategy›Source · Provider model documentation, 2023–2025
→1 cited answer Then: 10 blue links. Now: 1 cited answer.
10 → 1
Ten blue links became one answer, citing a few sources
AI Overviews, ChatGPT search and Perplexity answer directly and cite a few sources; being cited takes technical work.
What we do about it
We make pages easy to quote and report AI citations beside rankings and revenue each month.
08Search›Source · Google, OpenAI and Perplexity product pages
→Hours to report Then: Annual audit. Now: Hours to report.
6 h
To report a cyber incident in India
The DPDP Act 2023, the EU AI Act and CERT-In's six-hour incident rule make security, privacy and AI governance part of delivery.
What we do about it
We build consent checks, AI labels, security testing and audit logs into the work, so evidence exists at release.
06Security›Source · CERT-In Directions, 28 April 2022
How it works
Each of the ten capabilities builds one or more layers. Pick a layer to see which, or follow one customer question through all four.
An architecture diagram in four layers. Experience: website and web app, mobile app, support chat, search and AI answers. Intelligence: support agent, retrieval, workflow automation, evals. Platform and data: custom apps and CRM, customer data, integration bus, AI gateway, GPU and serverless compute. Trust and operations runs alongside every layer: security and guardrails, observability, audits and the on-call squad. The steps below trace one request through it.
Builds the whole platform
L1 · Experience
L2 · Intelligence
L3 · Platform & data
L4 · Trust & operations
Our default core technologies
AI models · behind the gateway, swappable
L1 · built by 2 capabilities
What customers see: websites, mobile apps, chat, search and AI answers.
L2 · built by 2 capabilities
AI agents, answers from your documents and automated workflows inside the product.
L3 · built by 3 capabilities
Custom apps and CRM, customer data, integrations, the AI gateway and cloud computing.
L4 · built by 3 capabilities
Security, audits, monitoring and the on-call team, across every layer.
One request, step by step Illustrative
Sample plans
Choose a goal to see the capabilities, build order, phases, team and quality checks we would typically plan, and what we would measure in the first 90 days.
Plan: Launch an AI support assistant · 6 phases · 12 weeks · 6 capabilities
Architecture · capabilities involved6 of 10
The capabilities involved in the selected plan are highlighted on the platform map and numbered in build order.
Plan 1 of 5 · typical
Answers customer questions from your own knowledge and records, hands off to people when unsure.
Team
Quality gates · must pass
First 90 days · we measure
Frameworks this plan aligns with
Plan 2 of 5 · typical
One customer record your sales and service teams trust, migrated without losing a quarter.
Team
Quality gates · must pass
First 90 days · we measure
Frameworks this plan aligns with
Plan 3 of 5 · typical
Good Core Web Vitals in the field, on the mid-range Android phones most customers actually carry.
Team
Quality gates · must pass
First 90 days · we measure
Frameworks this plan aligns with
Plan 4 of 5 · typical
Your pages ranked on Google and quoted by AI Overviews, ChatGPT and Perplexity for the questions buyers ask.
Team
Quality gates · must pass
First 90 days · we measure
Frameworks this plan aligns with
Plan 5 of 5 · typical
Vetted AI engineers inside your sprints, shipping a first feature to production with evals from day one.
Team
Quality gates · must pass
First 90 days · we measure
Frameworks this plan aligns with
Plans show typical phases and lengths and are not a quote. We scope every engagement with your team before work starts.
Tech stack
174 technologies across 18 layers, from languages to collaboration tools. We are tied to no single model or cloud: each choice is made per task on evidence and revisited when the evidence changes.
Technologies we work with. No partner, reseller or certification tier is implied by any mark on this page.
Layer
174 technologies · 18 layers
In all eighteen layers, each choice is made per engagement on evidence, written up in an architecture decision record and kept reversible.
Use the arrow keys to move between technologies; the selected technology is described in the panel beside the wall.
Standards & frameworks
We build to these frameworks, so the work itself produces the evidence an auditor asks for. The badges are our own drawings; none is an official seal.
Choose a framework to see what it governs, how it shows up in delivery and which capability pages apply it. The details appear in the panel after the list.
01Security & privacy14 frameworks
02AI governance5 frameworks
03Quality & accessibility3 frameworks
04Sustainability & operations4 frameworks
We also use these without a badge: ISO/IEC 25010 quality characteristics in our definitions of done; the NIST AI 600-1 generative-AI profile alongside the AI RMF; and the FinOps Framework for cloud cost reviews. The OWASP Top 10 for LLM Applications entry follows the 2025 list.
Alignment describes how we work. It does not mean Xterra Edze holds a certification. ISO 9001 and ISO 14001 are management systems for whole organisations; we follow their practices in delivery. Certifications held by Xterra Edze itself: to be confirmed before launch.
Framework1 / 26
Security & privacy · Standard
Information security management systems · ISO / IEC
What it governs
Requirements for an information security management system: risk assessment and treatment, with 93 Annex A controls across organisational, people, physical and technological themes.
How it shows up in delivery
Access reviews, change control, supplier risk and logging are built into delivery, so the evidence exists as the work is delivered.
Security & privacy · Attestation framework
Trust Services Criteria · AICPA
What it governs
Controls for security, availability, processing integrity, confidentiality and privacy. Type I tests design at a point in time; Type II tests operation over a period.
How it shows up in delivery
Change approvals, access logs and incident records captured automatically, ready for your auditor.
Security & privacy · Framework
Cybersecurity Framework · NIST
What it governs
Six functions for managing cybersecurity risk: Govern, Identify, Protect, Detect, Respond and Recover.
How it shows up in delivery
Current and target profiles that turn security posture into a prioritised, costed roadmap.
Security & privacy · Framework
Critical Security Controls and Benchmarks · Center for Internet Security
What it governs
Prioritised safeguards grouped into implementation groups, plus hardening benchmarks for cloud, container and operating-system configurations.
How it shows up in delivery
Cloud accounts, clusters and images hardened to CIS Benchmarks and scanned continuously for unapproved changes.
Security & privacy · Standard
Application Security Verification Standard · OWASP
What it governs
Testable security requirements for web applications and APIs, organised in three verification levels by risk.
How it shows up in delivery
Security requirements written as acceptance criteria at the level your risk profile needs, and verified in CI.
Security & privacy · Awareness standard
Web application security risks · OWASP
What it governs
The most critical web application risks, from broken access control and injection to security misconfiguration.
How it shows up in delivery
Threat-modelled at design, scanned on every merge and tested manually before release.
Security & privacy · Framework
Supply-chain Levels for Software Artifacts · OpenSSF
What it governs
Levels of assurance for how software artifacts are built, with verifiable build provenance.
How it shows up in delivery
Signed builds, provenance attestations and an SBOM in SPDX or CycloneDX for every release.
Security & privacy · Standard
Payment Card Industry Data Security Standard · PCI Security Standards Council
What it governs
Twelve requirements for protecting cardholder data wherever it is stored, processed or transmitted.
How it shows up in delivery
Scope reduced first, with tokenised payments and segmented networks, then controls built for what remains.
Security & privacy · Regulation
Safeguards for electronic protected health information · US HHS
What it governs
Administrative, physical and technical safeguards for electronic protected health information (ePHI).
How it shows up in delivery
Access control, audit trails and encryption for ePHI, with business associate agreements for every processor.
Security & privacy · Regulation
General Data Protection Regulation (EU) 2016/679 · European Union
What it governs
Lawful basis, data-subject rights, data protection by design and by default, breach notification and DPIAs for high-risk processing.
How it shows up in delivery
Consent, retention and data-subject request flows designed into the product, with DPIAs where the risk calls for one.
Security & privacy · Law
Digital Personal Data Protection Act, 2023 · Government of India
What it governs
Notice and consent, duties of data fiduciaries, rights of data principals, breach intimation and added duties for significant data fiduciaries, with the DPDP Rules.
How it shows up in delivery
Consent records, notices and data-principal request handling built for India-based users from the first release.
Security & privacy · Standard
Privacy information management systems · ISO / IEC
What it governs
Requirements and guidance for managing personally identifiable information as a controller or processor.
How it shows up in delivery
Data maps, retention rules and processor records kept alongside the systems that hold personal data.
Security & privacy · Regulation
Cyber incident reporting directions · CERT-In, Government of India
What it governs
Reporting of specified cyber incidents within six hours, log retention for 180 days within India and clock synchronisation.
How it shows up in delivery
Incident runbooks, log retention and time synchronisation configured so reporting deadlines can be met.
Security & privacy · Directive
Network and Information Security Directive (EU) 2022/2555 · European Union
What it governs
Cybersecurity risk-management measures, supply-chain security and staged incident reporting for essential and important entities.
How it shows up in delivery
Risk measures and incident reporting stages mapped to the services we build and run for in-scope clients.
AI governance · Standard
Artificial intelligence management systems · ISO / IEC
What it governs
Requirements for establishing, running and improving an AI management system: AI policy, impact assessment, data and lifecycle controls.
How it shows up in delivery
An AI inventory, impact assessments and lifecycle controls are part of how every model and agent is released.
AI governance · Framework
AI Risk Management Framework · NIST
What it governs
Four functions for trustworthy AI: Govern, Map, Measure and Manage, with a companion profile for generative AI (NIST AI 600-1).
How it shows up in delivery
Risks mapped per use case, measured with evaluation sets and managed with named owners and release thresholds.
AI governance · Regulation
Artificial Intelligence Act (EU) 2024/1689 · European Union
What it governs
A risk-based regime: prohibited practices, obligations for high-risk systems, transparency duties and rules for general-purpose AI models.
How it shows up in delivery
Each use case classified by risk tier early, with transparency notices, logging and human oversight designed in.
AI governance · Awareness standard
Security risks in generative AI applications · OWASP GenAI Security Project
What it governs
Risks specific to applications built on AI models, including prompt injection (LLM01), sensitive information disclosure (LLM02), excessive agency (LLM06) and vector and embedding weaknesses (LLM08).
How it shows up in delivery
Red-team suites for prompt injection, data leakage and tool misuse run in CI before any model or agent release.
AI governance · Knowledge base
Adversarial Threat Landscape for AI Systems · MITRE
What it governs
Adversary tactics and techniques against machine-learning and AI systems, drawn from real attacks and red-team research.
How it shows up in delivery
Threat models for AI systems mapped to ATLAS techniques, then exercised in red-team tests.
Quality & accessibility · Standard
Web Content Accessibility Guidelines · W3C
What it governs
Perceivable, operable, understandable and robust content, including 2.2 criteria such as focus not obscured, target size and accessible authentication.
How it shows up in delivery
Automated checks in CI plus manual keyboard and screen-reader passes on every key journey.
Quality & accessibility · Metric set
Loading, interactivity and visual stability · Google
What it governs
Good at the 75th percentile of page loads: LCP ≤ 2.5 s, INP ≤ 200 ms, CLS ≤ 0.1.
How it shows up in delivery
Performance budgets enforced in CI, with field data tracked at the 75th percentile for every template.
Quality & accessibility · Standard
Quality management systems · ISO
What it governs
Requirements for a quality management system built on process control, risk-based thinking and continual improvement.
How it shows up in delivery
Definitions of done, peer review and release checklists that make quality repeatable.
Sustainability & operations · Specification
Software Carbon Intensity · Green Software Foundation
What it governs
A rate of carbon emissions per functional unit: SCI = ((E × I) + M) per R, where E is energy, I is grid carbon intensity, M is embodied emissions and R the unit.
How it shows up in delivery
Carbon measured per request, user or inference, so efficiency work has a baseline.
Sustainability & operations · Metric set
Software delivery performance · DORA (DevOps Research and Assessment)
What it governs
Deployment frequency, change lead time, change failure rate and failed deployment recovery time.
How it shows up in delivery
Measured from your pipeline from week one, so delivery speed and stability are reported with numbers.
Sustainability & operations · Standard
Environmental management systems · ISO
What it governs
Requirements for managing environmental aspects, compliance obligations and performance improvement.
How it shows up in delivery
Hosting, device and data-transfer impact recorded beside cost, with reviewed reduction targets.
Sustainability & operations · Standard
Business continuity management systems · ISO
What it governs
Requirements for planning, testing and improving the ability to keep operating through disruption.
How it shows up in delivery
Recovery time and recovery point objectives set per service, then tested with restore and failover drills.
Where it applies · 6 of 10 capability pages
Control mapping
We build access and audit logging once, in the gateway and every service. The same logs meet clauses in six frameworks, which keeps alignment affordable.
An audit log tail showing access events with the actor, action, resource, authentication method, result and trace identifier, including an agent's tool call with its model route and prompt version, a denied export and a person approving a deployment.
How we use AI
Agents draft the spec, the tests and the deployment. Every change then goes through automated tests, AI evaluations and security scans. The console below follows one ticket through eight stages.
An interactive delivery console. One ticket, adding refund status to a support assistant, runs through eight stages: an agent drafts the spec and the tech lead approves it; an engineer codes with an AI pair and opens pull request 1482; a test agent adds 14 tests; the eval suite passes 148 of 148 cases with faithfulness 0.94; security scans find nothing critical; a named engineer reviews and approves the merge; an agent canaries the release from 5 to 100 percent; and production is observed against its SLO. Other tabs show the code diff, the eval report against its gates and the audit log.
Stage 01 of 8Agent + person
An agent drafts acceptance criteria and edge cases from the ticket. The tech lead edits them and approves.
Output6 criteria · 3 edge cases · approved
Stage 02 of 8Agent + person
An engineer builds the change with an AI pair in the IDE and opens a pull request with a written summary.
OutputPR #1482 · +212 −38 · 7 files
Stage 03 of 8Agent
A test agent writes unit and contract tests for the change. The engineer keeps the ones that earn their place.
Output+14 tests · coverage 81.2% → 84.6%
Stage 04 of 8Agent
The golden set runs against the AI feature: faithfulness, refusals, latency and cost, compared with main.
Output148 / 148 pass · faithfulness 0.94
Stage 05 of 8Agent
SAST, dependency, container and secret scans run on the branch, with prompt-injection cases (OWASP LLM01) in the suite.
Output0 critical · 0 high · 0 secrets
Stage 06 of 8Person
A named engineer reads the diff, the eval report and the scan results, then approves or asks for changes. Agents cannot merge.
Waiting for a named engineer. Agents cannot merge.
✓Approved by the tech lead · 17:12 · logged
Stage 07 of 8Agent
Canary to 5% of traffic, then 25% and 100% while error rate and latency hold. It rolls back on its own if they do not.
Outputcanary 5% → 25% → 100% · 0 rollbacks
Stage 08 of 8Agent + person
Traces, SLO burn and eval drift are watched in production. The on-call engineer owns anything that moves.
OutputSLO 99.96% · burn 0.4× · no drift
#1482Answer refund status from the order system, hand off on low confidence
services/support/answer.py+14−1Drafted with an AI pair · reviewed by the tech lead
@@ -41,9 +41,24 @@ def answer(question: str, customer: Customer) -> Answer: context = retrieve(question, customer_id=customer.id, k=8) return llm.complete(PROMPT.format(q=question, ctx=context)) if intent(question) == "refund_status": order = tools.orders.lookup(customer.id, scope="read") context.append(order.as_citation()) draft = gateway.complete( route="support.answer", # small model first, escalates on low confidence prompt=PROMPTS["answer@v14"], question=question, context=context, ) checked = guardrails.check(draft, policy="support@v6") # PII, claims, injection if checked.confidence < 0.62: return handoff.to_human(question, draft, reason="low_confidence") return checked.answer
Review noteTool call is read-scoped. Handoff threshold matches the value calibrated on the golden set. Approved.
golden-set@v14 · 148 cases · judge calibrated against expert labelsAll gates pass
| Metric | This branch | Against the gate | Gate | Main |
|---|---|---|---|---|
| Faithfulness | 0.94 | ≥ 0.90 | 0.93 | |
| Answer relevance | 0.91 | ≥ 0.85 | 0.90 | |
| Citation accuracy | 0.97 | ≥ 0.95 | 0.96 | |
| Correct refusals | 1.00 | = 1.00 | 1.00 | |
| Injection cases blocked | 24 / 24 | = 24 | 22 / 22 | |
| p95 latency | 1.9 s | < 2.5 s | 2.1 s | |
| Cost per answer | $0.004 | ≤ $0.006 | $0.005 |
Why it mattersModels and prompts change. The same 148 cases run on every change, so a regression blocks the merge instead of reaching a customer.
| Time | Actor | Action | Model · prompt | Reviewer | Result |
|---|---|---|---|---|---|
| 14:02 | spec.agent | Drafted acceptance criteria | route:large · spec@v7 | Tech lead | Approved |
| 14:31 | ide.pair | Suggested 38 lines in 3 files | route:code | Tech lead | 31 kept |
| 16:40 | test.agent | Generated 14 tests | route:code · tests@v3 | Tech lead | 12 kept |
| 16:46 | eval.runner | Ran golden set v14 | judge@v5 | — | Pass |
| 17:12 | Tech lead | Approved merge of PR #1482 | — | — | Merged |
| 17:34 | deploy.agent | Canary 5% → 100% | — | On-call | Live |
RetentionKept with the pull request and the release, exportable to your SIEM, and sampled in the monthly audit.
Agents draft, test and deploy. A named engineer approves every merge and every production change.
Model, prompt version, inputs, output and reviewer, kept with the pull request and the release.
Enterprise model endpoints with training turned off, in your region where required.
Credentials stay in the vault. Agents call tools with scoped, short-lived tokens.
What we track on every programme · DORA metrics Illustrative
Model updates
Each new model is tested on your own cases and adopted only when it scores better or costs less. Changes reach production in a weekly release that must pass four checks.
Model changelog · last 12 months
A chart of the last twelve months. Nine model releases are marked along the top. The eval score on the golden set rises in steps from 0.81 to 0.93 as six of them are adopted, while the cost per thousand requests falls from 2.40 to 1.02 dollars. Each release can be chosen to see how it was evaluated and what changed.
Weekly releases · 12 weeks Illustrative
Twelve weekly releases. Eleven went live, with 9 to 23 changes each. Week 7 was held because a refund-intent test score dropped from 0.92 to 0.86; the fix went live in week 8.
W7 held. The refund-intent test score dropped from 0.92 to 0.86. Nothing went live; the fix went out with W8.
11 of 12 releases went live1 held by AI tests0 rollbacks
Idea to agent · typical Typical ranges
How we work with you
Product, engineering, AI and security teams share the same sprints from week one, and four gates decide when work moves on. Choose a phase to see its decision, team and agent tasks.
A programme plan in five phases, Discover in weeks 1 to 2, Design in weeks 2 to 4, Build in weeks 4 to 16, Launch in weeks 16 to 18 and Run from week 18, across four lanes: product and design, engineering, AI and data, security and quality. Gates: architecture approved after Design, security sign-off after Build, go-live after Launch, and a 90-day review in Run.
Phase 01 · Wk 1–2
Ends in a decisionWhat to build first, what it must achieve and whether the data can support it.
Deliverables
Who takes part
Your sponsorYour product ownerDomain expertsProgramme leadSolution architectAI lead
Where agents assist
Phase 02 · Wk 2–4
Ends in a decisionThe architecture, the build order and the quality gates the build has to pass.
Gate · Architecture approved
Deliverables
Who takes part
Solution architectTech leadProduct designerSecurity engineerYour IT and security leads
Where agents assist
Phase 03 · Wk 4–16
Ends in a decisionEvery two weeks: what this sprint delivers, shown working in the demo.
Gate · Security sign-off
Deliverables
Who takes part
Tech leadEngineersProduct designerQA and evaluation engineerYour product owner, weekly
Where agents assist
Phase 04 · Wk 16–18
Ends in a decisionGo live, with the rollback rehearsed and the on-call rota staffed.
Gate · Go-live
Deliverables
Who takes part
Release managerSite reliability engineerSecurity engineerYour support leadYour sponsor
Where agents assist
Phase 05 · Wk 18 →
Ends in a decisionEvery month: what to improve next, decided on service targets, test results and cost.
Gate · 90-day review
Deliverables
Who takes part
Service ownerOn-call squadYour product ownerYour finance partner, for cloud cost
Where agents assist
A goal per sprint, agreed with your product owner.
Working software you can click through on a preview environment.
Architecture decision records, so choices outlive the people who made them.
Written as features land and rehearsed before launch.
Sustainability
AI adds energy to every request. We measure carbon per request with the Green Software Foundation's Software Carbon Intensity (SCI) standard, ISO/IEC 21031, and cut it with the same changes that cut cost.
SCI per request, per active user or per 1,000 tokens, with what is counted written down.
The SCI specification excludes certificates and offsets, so the figure counts reductions only.
We weigh speed, data residency under the DPDP Act and grid carbon together, and record the choice.
Region · grid intensity and round trip from Delhi users
India West is the default because it carries the widest service coverage of the Indian regions, which usually decides it. India North is cleaner and closer to Delhi users, so it wins wherever its services cover the workload. The choice is made per engagement; both keep data in India.
Practices
Where the carbon went · gCO₂e per request
0.18gCO₂e per request
62% below baseline · 179 g per 1,000 requests
A small model answers first; the large model is used only when the small one is unsure.
Energy per request down 30–60% on routed traffic
A cache answers repeated questions; offline jobs run in batches instead of one call at a time.
Model calls down 20–40%
Embeddings, reports and fine-tuning run at hours or in regions with a cleaner grid, using live grid data.
Batch emissions down 10–30%
Image, font and JavaScript size limits are checked on every build, so each visit sends less data to the phone.
Page weight down 30–50%
Services scale to zero overnight, clusters are right-sized and unused resources are deleted in a monthly sweep.
Idle spend and hardware carbon down
Typical effects are ranges from published practice and are not client results. Grid intensities are illustrative annual averages; live figures come from your cloud provider and grid data when measured.
Industries
Regulation, data residency, latency and human review differ by sector, and we settle each before any code is written. Choose yours to see what applies.
Sector01 / 08
Regulatory notes are a summary for orientation and are not legal advice.
01 · PCI DSS · RBI · SEBI
Payments must be fast, and every decision needs an audit trail.
Capabilities most used
06Security›02Platforms›05AI Infrastructure›07Integration›09Audits›
Frameworks that apply
Typical first projectA security and AI-readiness audit, then a fraud-triage assistant with human approval.
02 · HIPAA · DPDP · clinical safety
Clinical safety comes first, and health data needs the strictest care.
Capabilities most used
Frameworks that apply
Typical first projectVisit summaries drafted by AI, signed off by the clinician on every note.
03 · Core Web Vitals · sale days
Sale-day traffic, mid-range phones and AI search answers shape revenue.
Capabilities most used
01Web & Apps›08Search›02Platforms›07Integration›05AI Infrastructure›
Frameworks that apply
Typical first projectFaster product and checkout pages, measured on live visits and conversion.
04 · OT security · edge
Plants run on control systems that cannot stop for an upgrade.
Capabilities most used
Frameworks that apply
Typical first projectConnect MES and ERP data, then a vision-inspection pilot on one line.
05 · Children's data · accessibility
Results days bring the peaks, and children's data needs the most care.
Capabilities most used
Frameworks that apply
Typical first projectAn accessible student portal, load-tested for results day.
06 · Events · integrations · offline
Every shipment is an event, and every event has to reach the right system.
Capabilities most used
Frameworks that apply
Typical first projectOne event stream across carriers, warehouse and ERP, with WhatsApp updates to customers.
07 · Residency · audit · languages
Data residency, accessibility and audit trails are required from the start.
Capabilities most used
Frameworks that apply
Typical first projectA security and accessibility audit, then a multilingual citizen-service assistant.
08 · SOC 2 · tenancy · AI features
Enterprise buyers ask for evidence before they sign.
Capabilities most used
02Platforms›04AI Product›05AI Infrastructure›06Security›10Workforce›
Frameworks that apply
Typical first projectSecurity-questionnaire readiness, then an AI feature built with tenant isolation.
Measures
Speed, reliability, AI quality, security, cost and carbon, reported monthly. Each number has a written definition and a target agreed before launch, so your CTO, CFO and auditor read it the same way.
Service report · Xterra Edze
Your platform
Six concerns · targets agreed before launch · definitions printed beside every number Illustrative
2.1s ▼ 1.7 s · 12 months
p95 API latency212 ms
Definition · Speed
Largest Contentful Paint at the 75th percentile of real page loads on mobile. Core Web Vitals rate it good at 2.5 s or less, alongside INP ≤ 200 ms and CLS ≤ 0.1. p95 API latency: 95% of requests finish faster than this.
99.97% ▲ 0.25 pts · 12 months
Error budget left71% · 12.5 of 43.2 min used
Definition · Reliability
The share of requests served well over the window. A 99.9% monthly SLO allows 43.2 minutes of failure in 30 days: the error budget. When it runs out, releases pause and reliability work goes first.
0.94 ▲ 0.10 · 12 months
Eval pass rate148 / 148 cases
Definition · AI quality
The share of claims in an answer that the retrieved sources support — faithfulness, also called groundedness — scored by a judge calibrated against expert labels. The same golden set of real cases runs on every change to a model, prompt or data source. One term, one number, one gate: the hero readout, the run log and the composer all report this figure.
0 ▼ 6 · 12 months
MTTR · high severity3.2 days
Definition · Security
Confirmed critical findings from scans, penetration tests and reports, counted until the fix is verified in production. MTTR is the mean time from a finding being confirmed to its fix going live.
$1.02 ▼ $1.38 · 12 months
Spend vs monthly budget94%
Definition · Cost
Compute, model tokens, storage and egress divided by requests served, per 1,000. Reviewed with finance every month using the FinOps Framework, because unit cost says more than the total bill.
0.18gCO₂e ▼ 0.29 g · 12 months
Batch jobs run carbon-aware86%
Definition · Carbon
Software Carbon Intensity, ((E × I) + M) per R, from the Green Software Foundation (ISO/IEC 21031:2024), with R as one request. Offsets are excluded by design, so it only falls when the software uses less.
Weekly
Error-budget burn, incidents, AI test scores and anything that paged someone, in fifteen minutes with the on-call engineer.
Monthly
All six measures against target, including cost and carbon per unit, and what we will change next month.
Quarterly
The measures agreed before launch, the roadmap and DORA metrics on how delivery is running.
Where we work
Offices in New Delhi and Ludhiana on India Standard Time (UTC+5:30), and in Saint John, Canada, on Atlantic Time. Between them, our office hours overlap most of the working day in Europe, the Gulf, South-East Asia and North America.
Office 01 · India
03:55 IST · UTC+5:30
Work led here
Office 02 · India
03:55 IST · UTC+5:30
Work led here
Office 03 · Canada
19:25 ADT · UTC−3
Overlap
Your working day against ours, hour by hour
Offices · IndiaIST · UTC+5:30
9 hoffice hours
Office · CanadaSaint John · ADT · UTC−3Saint John · AST · UTC−4
Saint John office, Northern summer: open 09:00–17:00 ADT, which is 17:30–01:30 India time.Saint John office, Northern winter: open 09:00–17:00 AST, which is 18:30–02:30 India time.
United KingdomLondon · BST · UTC+1London · GMT · UTC+0
United Kingdom, Northern summer: a 09:00–17:30 local working day shares 8.5 h with our office hours. United Kingdom, Northern winter: a 09:00–17:30 local working day shares 8.5 h with our office hours.
EuropeFrankfurt · CEST · UTC+2Frankfurt · CET · UTC+1
Europe, Northern summer: a 09:00–17:30 local working day shares 8.5 h with our office hours. Europe, Northern winter: a 09:00–17:30 local working day shares 8.5 h with our office hours.
GulfDubai · GST · UTC+4Dubai · GST · UTC+4
Gulf, Northern summer: a 09:00–18:00 local working day shares 9 h with our office hours. Gulf, Northern winter: a 09:00–18:00 local working day shares 9 h with our office hours.
SingaporeSingapore · SGT · UTC+8Singapore · SGT · UTC+8
Singapore, Northern summer: a 09:00–18:00 local working day shares 5.5 h with our office hours. Singapore, Northern winter: a 09:00–18:00 local working day shares 5.5 h with our office hours.
US EastNew York · EDT · UTC−4New York · EST · UTC−5
US East, Northern summer: a 09:00–17:30 local working day shares 7 h with our office hours. US East, Northern winter: a 09:00–17:30 local working day shares 7 h with our office hours.
Local working days shown as 09:00–17:30 (09:00–18:00 in the Gulf and Singapore). Shared hours count the office days in India and in Saint John. Handovers are written down: open incidents, releases in progress and anything waiting for approval.
Services & packages
Services you can start with, from our ten technology capabilities. Pick one and your enquiry reaches the right team with it attached. Each comes as a short sprint, a fixed-scope project or an ongoing team.
How to buy
How we work with you
Ask a quick question, send a project brief or issue a formal RFQ. The lead for the work reads each one in full, and any services already in your brief go with it.
Or book a thirty-minute call01
For a first conversation, a press request or anything that does not need a scope yet.
You get A reply from a named lead
02Recommended
Goals, audiences, a budget band and timing, so our first reply can outline the work.
You get Options and a first scope after one call
03
Your documents, deadlines and the procurement and security rules the work must meet.
You get Receipt confirmed and a named bid lead
How it is priced
Each package shows its pricing model. Work starts once a written scope and quote are agreed.
Opens a project brief with this package chosen.
In your brief
In your brief
In your brief
In your brief
In your brief
In your brief
| Package | Every engagement includes | Best for |
|---|---|---|
| SprintA short, fixed-scope engagement that answers one defined question. |
|
Discovery, a diagnostic, a prototype or a decision you need to make soon |
| ProjectA defined scope, delivered for a fixed price. |
|
Work you can describe up front: an identity, a platform or a set of tools |
| MilestoneA larger build in phases you approve and pay for one at a time. |
|
Programmes too large for one contract, where you want control at each step |
| RetainerReserved monthly capacity to run, improve and extend what we built. |
|
Live brands and products that need a steady team without hiring one |
| EnterpriseA multi-workstream programme with a dedicated team, governance and agreed service levels. |
|
Large organisations running change across markets, portfolios or business units |
| SquadA dedicated team that works inside your stack and sprint schedule. |
|
Teams with a clear roadmap that need more senior people quickly |
How we work with you
Answers to what procurement, legal, IT and security teams ask, each shown with the setting or rule that enforces it.
Source code, infrastructure code, prompts, evaluation sets and model and gateway configuration live in your repositories from the first commit, and are yours once paid for.
Enforced asrepository
repo.owner = "your-org"ip.assignment = "on payment"includes = [code, iac, prompts, evals, model_config]
Every model sits behind a gateway and an eval suite. Changing provider, or bringing a model in-house, is a configuration change we can demonstrate, not a rebuild.
Enforced asgateway config
route "support.answer" { model = var.model }switch.requires = "golden set ≥ gate"exit = open formats, your keys
Least-privilege access, your single sign-on where you have it, secrets in a vault, scans on every build, and your security questionnaire answered during scoping, not after.
Enforced asCI policy
ci.required = [sast, deps, secrets, iac, image]access = sso + mfa, least privilegesecrets = vault only · never in prompts
Agents draft, test and propose. A named person approves every merge, every production change and any action that reaches your customers, and every AI action is logged.
Enforced asbranch protection
main.required_reviews = 1 # a named personagents.can_merge = falseai_actions.log = [model, prompt, reviewer]
Targets for speed, reliability, AI quality, security, cost and carbon are agreed before launch and reported every month with their definitions, good months and bad.
Enforced asservice report
report.monthly = [cwv_p75, slo_30d, evals, vulns,cost_per_1k, sci_per_request]targets = "agreed before launch"
Architecture decisions, runbooks, dashboards and onboarding guides are written as the work lands and accepted like any other deliverable, so your team can run it without us.
Enforced asdefinition of done
done += [adr, runbook, dashboard, alert, owner]handover = "rehearsed, not emailed"
Our work is aligned with ISO/IEC 27001, SOC 2 and ISO/IEC 42001. That is not a certification claim; certificates come from independent auditors.
Questions
Anything else? Ask the engineers who would run the work, or sketch a plan first.
Yes. You can start with one: an audit, a single AI feature, a website or a squad. Each is scoped and priced on its own and built to connect with the rest when you are ready.
Whichever scores best on your own examples. We work with models from OpenAI, Anthropic, Google, Meta and Mistral and with open-weight models in your cloud. All are called through one gateway and chosen per task on quality, speed and cost. When a new model arrives, we test it on the same examples and switch only if it does better.
Yes. We deploy into your AWS, Azure or Google Cloud account, including India regions, and use enterprise model endpoints with training on your data switched off. Where data may not leave your network at all, open-weight models run inside it.
You do. What we make for you is yours once it is paid for, including code, prompts, evaluation sets and model settings. Tools we already had stay ours, and you get a free, permanent licence to use them.
Related02Platforms›10Workforce›
Early and in writing. We answer your questionnaire during scoping, work under your policies and produce the evidence your auditors ask for as part of delivery. If you are working towards ISO/IEC 27001 or SOC 2, we prepare you for the independent auditor who issues the certificate or report.
Related06Security›09Audits›
Typically four to eight weeks from a defined problem to production. A prototype runs on your data within days and test baselines are set in week one. A pilot with named users starts by week three, with automatic checks in place. Regulated or high-risk uses take longer because review does.
Yes, in whichever shape helps. Engineers can join your sprints, a squad can own a stream of work or we can review and pair while your team builds. Knowledge transfer is planned from the first week.
Related10Workforce›07Integration›
You choose: a managed service with agreed service levels, or a handover to your team with runbooks, dashboards and training. Either way, we review the first 90 days against the measures agreed before launch.
Related07Integration›10Workforce›
You will speak to a lead who would run the work, and get a straight answer on fit.
Three ways to start
Every engagement starts with a written scope and a quote agreed before work begins.
Choose one of the three ways above
