Nobody can reproduce production
Infrastructure built by clicking through a console. No one is confident they could rebuild it after a serious incident.
Service 07 / 14
Cloud Solutions
Cloud spend gets out of hand when infrastructure grows by clicking. We build reproducible, autoscaling infrastructure as code — on AWS, on Azure, or on your own hardware — and usually cut the bill while doing it.
- Typical duration
- 6–16 weeks
- Engagement
- Team of 2–3 · Fixed scope or retainer
- Right for you if
- Companies whose cloud bill grows faster than their usage
- Teams migrating off ageing on-premise hardware
- Products that fall over during traffic peaks
- Anyone whose infrastructure exists only in one person's memory
Problems
You're probably here because of one of these.
If more than one sounds familiar, that's normal — they usually share a root cause.
The bill keeps climbing
Oversized instances, forgotten environments and unmonitored egress. Most audits we run find 30–50% of spend doing nothing.
Traffic peaks take you down
Fixed capacity sized for the average, so your best sales day becomes an outage.
Backups are untested
Snapshots exist. Nobody has ever restored one. That's not a backup, it's a hope.
Approach
How the work actually runs.
From first conversation to running in production. Typical end-to-end duration for cloud solutions is 6–16 weeks.
- 01
Discovery
1–2 weeksWe map the problem before proposing a solution. Stakeholder interviews, constraint analysis, and a written scope you actually own.
- Full inventory of current infrastructure and spend
- Dependency and data-flow mapping
- Risk assessment: single points of failure, untested recovery
- Migration plan with rollback at every stage
- 02
Architecture & design
2–3 weeksSystem design and interface design happen together, so the thing we draw is the thing we can actually build.
- Target architecture with capacity and cost modelling
- Network topology, security groups and IAM design
- Backup, retention and disaster-recovery strategy
- Environment parity: dev, staging and production
- 03
Build
4–10 weeksTwo-week iterations against a shared board. You get a working deployed environment from week one and a demo every sprint.
- Infrastructure defined as code and version controlled
- Autoscaling with sensible floors and hard ceilings
- Automated encrypted backups with restore verification
- Monitoring, alerting and log aggregation
- 04
Hardening
1–2 weeksAutomated test coverage, load testing, accessibility audit and a security review before anything touches production.
- Unit, integration and end-to-end test suites
- Load and performance profiling under realistic traffic
- WCAG 2.2 AA accessibility audit and remediation
- Dependency, authentication and access-control review
- 05
Launch
1 weekStaged rollout with monitoring in place before traffic arrives. Rollback is tested, not assumed.
- Phased migration with parallel running and cutover rehearsal
- Load testing against realistic peak traffic
- Documented runbooks for common incidents
- Cost dashboards with per-service attribution
- 06
Operate
OngoingWe stay on. Response-time SLAs, proactive dependency upgrades, and a roadmap review every quarter.
- Uptime, error and performance monitoring with alerting
- Defined severity levels and response-time commitments
- Scheduled dependency and security patching
- Quarterly roadmap and architecture review
Included
What you get, spelled out.
Every item here is part of the engagement, not an upsell discovered halfway through.
Infrastructure as code
Terraform-defined and version controlled. Production is reproducible from an empty account.
Autoscaling
Capacity that follows demand, with ceilings so a traffic spike can't produce a surprise invoice.
Cost optimization
Rightsizing, reserved capacity and lifecycle policies, with the savings quantified before and after.
Verified backups
Automated, encrypted, and restore-tested on a schedule so recovery is proven rather than assumed.
Multi-environment parity
Dev, staging and production built from the same definitions, so 'works on staging' means something — and the same definitions run on your own servers if you'd rather not be on a hyperscaler.
Monitoring and alerting
Metrics, logs and traces in one place, with alerts tuned to avoid fatigue.
Network security
Least-privilege IAM, private subnets, secrets management and encryption in transit and at rest.
Disaster recovery
Documented RTO and RPO targets, with the recovery procedure rehearsed.
Stack
What we typically build this with.
A default, not a rule. If your team already runs something else and it fits the requirement, we work in your stack.
AWS
Widest service coverage and the compliance posture enterprises expect.
Azure
Where the organization already lives in Entra ID and Microsoft 365.
Self-hosted
Your own servers, your own datacentre, or a VPS you control. Same containers, same pipeline, no cloud lock-in.
Docker
The same image in dev, CI and production. 'Works on my machine' ends here.
Kubernetes
At real scale only. Below it the operational cost outweighs the benefit, and we'll say so.
Terraform
Infrastructure in version control, reviewable and reproducible from an empty account.
Nginx
Reverse proxy, TLS termination and load balancing. What makes a self-hosted deployment behave like a managed one.
PostgreSQL
Our default. Transactional integrity, JSON, full-text search and row-level security in one engine.
Redis
Caching, rate limiting, queues and sessions. Boring in the best way.
Why Devsock
The difference is in how the work is run.
Ten dimensions where engagements usually go wrong, and what we do instead. Every claim in the right-hand column is something you can verify in the first two weeks.
DimensionTypical agencyDevsock
Estimates
TypicalAn hourly rate and a range that grows once work starts.
DevsockFixed scope and fixed price after a paid discovery. Changes are quoted before they enter a sprint.
Communication
TypicalA weekly status email written by an account manager.
DevsockDirect access to the engineers building it, a shared board you can read any time, and a demo every second week.
Code ownership
TypicalDelivered at the end, sometimes with a proprietary framework attached.
DevsockYour repository, your cloud account, from commit one. No proprietary layer, no licensing.
Testing
TypicalManual clicking before launch, if the timeline allows.
DevsockAutomated suites in CI, load testing at projected peak, and a WCAG 2.2 AA audit before release.
Architecture
TypicalWhatever the available developer knows best.
DevsockA written architecture decision record explaining what we chose, what we rejected, and why.
Security
TypicalAddressed if the client raises it.
DevsockDependency scanning in CI, least-privilege access, secrets management and a pre-launch review as standard.
Accessibility
TypicalOut of scope unless legally forced.
DevsockWCAG 2.2 AA designed in and audited. Keyboard and screen-reader tested, not assumed.
Handover
TypicalA zip file and a phone number that stops answering.
DevsockDocumented architecture, runbooks, and a paid handover period so your team can genuinely take over.
After launch
TypicalA new quote for every bug.
DevsockDefect fixes covered for 90 days. Support retainers carry response-time SLAs in the contract.
Saying no
TypicalEvery request becomes a line item.
DevsockWe'll tell you when a feature isn't worth building, or when the answer isn't software at all.
Work
What we've built, and what it changed.
Live products you can open and use. Each one names the constraint, the approach and what shipped.
- Next.js
- TypeScript
- React Native
- PostgreSQL
- Redis
- Stripe
- AWS
Multi-tenant SaaS platform and driver apps for dumpster rental operators
Challenge
Dumpster rental operators run bookings, fleet position, driver assignments and invoicing across spreadsheets, whiteboards and phone calls. Nobody knows where a container actually is, proof of service arrives days after the job, and billing gets reconstructed from memory at month end.
Solution
A multi-tenant SaaS platform with self-serve signup, subscription billing and tiered plans, paired with native driver apps on iOS and Android. Operators get real-time container status, driver scheduling with route optimisation, customer and contract management, and automated invoicing. Drivers receive job assignments and upload proof of service from the field.
What shipped
- Native driver apps published to both the App Store and Google Play
- Multi-tenant architecture with per-operator data isolation
- Self-serve onboarding with a 15-day trial and three subscription tiers
- Real-time inventory and container status tracking
- Driver scheduling with route optimisation
- Automated invoicing and payment processing
- Next.js
- TypeScript
- Tailwind CSS
- Vercel
Corporate platform for an independent renewable-energy consultancy
Challenge
An independent monitoring and evaluation consultancy for renewable energy projects needed to establish credibility with government, industrial and hospital buyers — a sector where procurement turns on verifiable regulatory standing and a demonstrable track record, not on marketing copy.
Solution
A structured corporate platform built around proof rather than persuasion: service definitions for independent oversight and technical training, a credentials section surfacing regulatory compliance across SECP, FBR, PRA and PEC, team profiles establishing sector experience, and a documented track record of verified installations. Enquiries route directly to the consultancy team.
What shipped
- Structured service architecture across oversight and training lines
- Regulatory credentials surfaced as the primary trust signal
- Track record documented across government, industrial and public-health installations
- Team credibility profiles with sector experience
- Enquiry capture routed to the consultancy team
- Server-rendered and fully indexable
- Next.js
- TypeScript
- PostgreSQL
- Tailwind CSS
- AWS
Training platform with multi-country scheduling and certificate verification
Challenge
A QHSE training provider delivering internationally accredited certifications across Saudi Arabia, the UAE and Pakistan needed to publish a constantly moving multi-city schedule, take registrations online, and let employers independently verify that a certificate is genuine — the last of which is what makes an accreditation worth anything.
Solution
A training platform combining a published course schedule across multiple countries with online registration, a separate corporate training enquiry path, and a public certificate verification tool employers can use to authenticate credentials. Accreditation bodies and trainer profiles are presented as structured, checkable content rather than a logo wall.
What shipped
- Public certificate verification for employers
- Multi-country training schedule with online registration
- Separate paths for open-enrolment and corporate training
- Course catalogue spanning ISO, OSHA, IOSH, NVQ and Lean Six Sigma
- Accreditation bodies and trainer credentials as structured content
- Server-rendered and fully indexable
Further work sits behind NDAs. We can walk you through the architecture and measured outcomes of those engagements under mutual NDA.
Request a walkthroughFAQ
Cloud Solutions — common questions.
Specific to this service. The general questions about pricing, ownership and process are answered on the home page.
Still unsure? hello@devsock.com
Whichever fits your team, compliance needs and existing commitments. We work across all three. If you have no preference we'll usually recommend AWS for breadth or Azure where you're already invested in Microsoft identity.
Related
Usually paired with.
Most engagements combine two or three of these. We'll tell you which ones you actually need.
Next step
Let's scope your cloud solutions project.
Bring us the problem rather than a specification. Thirty minutes with an engineer will tell you whether this is the right service, what it would take, and roughly what it would cost.
30 minutes
No slide deck, no sales team
An engineer
You speak to someone who builds
A straight answer
Including when it's don't build it