Identity and provisioning
SAML and OIDC against more than one identity provider, SCIM provisioning and deprovisioning, group-to-role mapping, and a break-glass path that still works when the provider itself is down.
SSO and SCIM wiringSoftware
Enterprise software that passes the security review
Internal platforms and customer-facing systems for organisations where identity is centralised and every change is logged. We scope the identity model, audit trail and integration seams before the first screen.
- Fixed scope
- Day 14 demo
- SSO and SCIM
- Full IP transfer
What enterprise actually means here
Enterprise usually gets read as large. In delivery it means something narrower: the software has to satisfy several people who will never open it — the identity team, the security reviewer, the external auditor, the procurement lawyer, and the on-call engineer who inherits it at three in the morning. Their requirements are unusually knowable in advance, which makes them worth pinning down first rather than discovering in month four.
Most of the risk sits in the seams, not the screens. A directory that reports stale job titles. A sandbox whose API contradicts its own documentation. A rate limit nobody published. A field that two systems both believe they own. Feature work is estimable from a written description; seams are not, until someone has made a real call against a real environment carrying real data volumes. So we price them separately.
| What is true of this work | What it forces | What we do about it |
|---|---|---|
| Identity lives in a central directory | No local password store | SSO wired to a real tenant |
| Visibility decided per record | Permissions become data, not conditionals | Policy model versioned and testable |
| An auditor reads the logs | Audit must be queryable and exportable | Append-only events inside the transaction |
| Other systems already own fields | Writes must be idempotent | Outbox plus reconciliation reporting drift |
| Change control is contractual | Every deploy traces to review | Ticket-to-production trail generated automatically |
In scope
- Identity, authorisation and audit foundations
- Adapters into your systems of record
- Environments, pipelines and change control
- Runbooks, restore drills and handover
Not in scope
- Issuing your SOC 2 report
- Long-run operations after the warranty
- Rewriting the legacy system underneath
Handled by
- Maintenance & SupportOngoing operations, on-call and patching after handover
- Legacy Application ModernizationRewriting or strangling the system underneath this one
What we build
Authorisation model
Permissions expressed as data rather than scattered conditionals: organisation and team hierarchies, record-level visibility, delegated administration, and a decision trail you can replay per user, per row, per date.
Tenant and role modelAudit trail and retention
An append-only event log written in the same transaction as the change it describes, carrying actor, subject and before-and-after values, with retention windows, legal hold and auditor-ready export.
Append-only audit trailSystem-of-record integration
Adapters into the platforms that already hold the truth — directory, HR, finance, CRM, warehouse — built with change data capture, a transactional outbox, idempotent writes, and a job that reports drift.
Integration seam contractsEnvironments and change control
Every environment defined in code, ephemeral review environments per branch, reversible migrations, releases gated behind flags, and a signed dependency inventory, so ticket-to-production stays traceable without anyone reconstructing it.
Environments defined in codeReliability engineering
A stated availability objective with an error budget behind it, defined degradation modes for each dependency, restores timed against a real backup, and alerts tied to user-visible symptoms.
Restore drill recordHow the work runs
- 01Week 1
Constraint audit
We start with the documents that constrain the build: security questionnaire, data processing agreement, retention policy, identity provider configuration, and the systems that already hold your data. Features are scoped after those are written down.
You getNon-functional requirements register
- 02Weeks 2–5
Identity and seams
We model tenants, roles and record visibility, then wire single sign-on to a real identity provider tenant inside the first fortnight. Each external system is called in its sandbox before we price against it.
You getWorking SSO and seam contracts
- 03Weeks 6 onward
Build under change control
We ship weekly behind flags, with each change traced from ticket to review to deployment. Audit events, permission checks and tests land alongside the feature that needs them, so compliance evidence accumulates as a by-product.
You getAuditable release history
- 04Final two weeks
Production readiness
We agree the availability objective, restore from a real backup and record the actual recovery time, walk an incident through with your on-call engineers, and remediate penetration test findings before handover.
You getRunbooks, drill results, access handover
What you are handed
- Threat model and data flow map
- Tenant, role and permission model
- SSO and SCIM wired to your directory
- Append-only audit trail with retention policy
- Integration seam contracts and replay tooling
- Every environment defined in Terraform
- Restore drill with recorded recovery time
- Security questionnaire evidence pack
- Runbooks, escalation paths and on-call rota
Typical stack
Application
TypeScriptNode.jsPythonDjango REST FrameworkReactNext.js
Data
PostgreSQLRedisDebezium CDCKafkaDjango and Alembic migrationsS3-compatible storage
Identity
SAML 2.0OIDCSCIM 2.0KeycloakOpenFGAHashiCorp Vault
Platform
TerraformKubernetesGitHub ActionsOpenTelemetryGrafanaPlaywright
The calls we make, and why
Should we build our own single sign-on and provisioning?
Buy the protocol layer, own the authorisation model
Assertion parsing, certificate rotation, SCIM endpoints and per-customer identity provider configuration are solved problems; every hour spent there is an hour not spent on your domain. Roles, group mappings and record visibility belong in your database, versioned and testable.
We’d choose otherwise whenyour customers require a protocol profile that no identity product on the market implements
Can you build us to five or six nines?
No — one region done properly, with a tested recovery objective
The gap is not technology, it is the operating cost of every nine: multi-region data consistency, an on-call rota deep enough to answer at any hour, and change friction on every deploy. That bill arrives monthly, whereas the architecture is bought once.
We’d choose otherwise whenyour contract carries service credits, or an hour of downtime costs more than warm standby
Is an audit trail just our application logs shipped somewhere?
Logs serve your engineers; audit serves someone else’s auditor
Emit audit events in the same transaction as the change, carrying actor, subject, before and after values, and a reason where a human exercised judgement. Then give the customer a filtered view they can query and export unaided.
We’d choose otherwise whenyour own security team is the only consumer and no customer contract mentions audit export
Do we read from the system of record live, or copy the data across?
Decide per field, not per system
Read live where correctness beats latency and the call sits on a user’s path — entitlements, balances, anything wrong when a minute stale. Replicate through change data capture where you need to join, search or report across systems, and own the reconciliation.
We’d choose otherwise whenone system is unambiguously authoritative for every field and no cross-system reporting is required
This fits if
- Deals stall at the security questionnaire and nobody owns the answers
- The system must live inside an existing directory and warehouse
- An auditor or major customer will read your access logs
- Several departments depend on it daily and outages have a named cost
Look elsewhere if
- You want SSO and audit before any customer has asked
- Your users are consumers or one team, and nobody audits access
- You want five nines on one region with nobody on-call
EngagementFixed-scope build
Typical length10–20 weeks
How it startsSend your security questionnaire, identity provider details and the list of systems we must integrate with.
Questions we get asked
Why does an enterprise build cost more than the same feature list elsewhere?
Because there is a second product underneath the feature list. Identity, authorisation, audit, environment control and integration hardening are quoted as their own workstream, itemised so you can defer the controls no customer has asked for yet. What we will not do is quote the screens and discover the control surface in month four.
Who owns the code, the infrastructure and the accounts?
You do, from the first commit. Repositories sit in your organisation, cloud resources in your accounts, domains and third-party services on your billing, and intellectual property transfers in full. We work as contributors with access you can revoke on any afternoon, so there is no handover moment where control changes hands.
Can you get us through SOC 2 or a customer security review?
We build the controls and generate the evidence, but we cannot issue the report — that comes from an independent audit firm after an observation window. The goal is that access reviews, change management, encryption, logging and vendor records already run as ordinary engineering habits before an auditor samples them. We draft the questionnaire responses.
What support exists after handover?
A thirty-day warranty covers defects in what we shipped. After that you can run it on the runbooks with your own team, keep us on a retainer with defined severities and response windows, or take a forward-deployed engineer inside your team. We would rather you had the option to leave than the obligation to stay.
How is our data handled during the build?
We build against synthetic or masked data by default, and treat access to production data as an exception that must be requested, approved and logged. Where residency rules apply, environments are pinned to the required region and the subprocessor list is agreed before anything is provisioned. Engineer access runs through your identity provider, never shared credentials.
Often bought alongside
Tell us the requirement.
Thirty minutes with the engineers who would build it. You leave with a scope, a timeline and a fixed price — or an honest no, and the reason why.