The tools we actually use
Every tool on this page we use in production with real clients. Each one has a reason. We do not add tools because they are new or because a vendor reached out.
CI/CD
Where we build, test, and deploy
Most of our clients already use GitHub. Tight integration, good secrets management, reliable.
For clients on GitLab or who need self-hosted runners and more control over the executor environment.
GitOps delivery for Kubernetes. Declarative, auditable, and the right default for anything running on k8s.
When we need Kubernetes-native pipelines without a separate SaaS dependency.
Infrastructure as Code
How we provision and manage cloud resources
Default choice. Mature, wide provider support, and most engineers already know it.
For complex multi-environment Terraform setups where DRY matters.
When clients want to write infrastructure in TypeScript or Python instead of HCL.
Kubernetes package management. We write and maintain Helm charts for client services.
Kubernetes
Orchestration, scaling, and service mesh
Our most common Kubernetes environment. AWS is where most of our clients run their workloads.
Second most common. Autopilot mode reduces operational overhead for teams without dedicated DevOps.
For clients on Azure, often due to existing Microsoft agreements or compliance requirements.
Node autoscaling on EKS. Replaces Cluster Autoscaler for almost every new engagement.
Service mesh for clients who need mTLS, fine-grained traffic control, or detailed telemetry between services.
Monitoring & Observability
What we use to know when something breaks
Metrics collection. We deploy it via the kube-prometheus-stack Helm chart in almost every engagement.
Dashboards. Every client gets a base set of dashboards for cluster health, deployment frequency, and error rates.
Log aggregation. Works well alongside Prometheus and Grafana, no separate log infrastructure to manage.
Distributed tracing instrumentation. Vendor-neutral so clients are not locked into a specific backend.
Alerting and on-call rotation. For clients who need 24/7 incident response.
Secrets Management
How we keep credentials out of code and out of repos
The default for clients who need a full secrets management platform with dynamic credentials.
Syncs secrets from AWS Secrets Manager, GCP Secret Manager, or Vault into Kubernetes Secrets.
Simpler option for clients already deep in the AWS ecosystem who do not need Vault's complexity.
For smaller teams who want a Vault alternative without the operational overhead.
Cloud
Where we run everything
Most common. We use EKS, RDS, S3, CloudFront, IAM, and the full standard stack.
GKE, Cloud SQL, Cloud Run, BigQuery for data-heavy clients.
For clients in regulated industries with Microsoft agreements or Azure AD requirements.
Compliance
Tools we use for ISO 27001, SOC2, and HIPAA work
Compliance automation. Connects to your cloud and code repos to collect evidence automatically.
Alternative to Drata. Used when clients are already in the Vanta ecosystem.
Container and IaC vulnerability scanning. Runs in CI, catches issues before they reach production.
Runtime security for Kubernetes. Detects anomalous behaviour at the container level.
Working with an existing stack?
We work with what you have. If you are already on a tool that is not on this list, we will use it. We only migrate when migration is genuinely the better option.
Book a free audit