Service
Leave the expensive cloud. Keep the security.
For small companies whose cloud bill has outgrown what they actually run. We move managed services onto infrastructure you control, one service at a time, and leave you with a system your own team can operate.
What we move, and where to
| Today | After |
|---|---|
| Managed Kubernetes: EKS, GKE | Kubernetes on hardware you own or a plain VPS. No control-plane fee, no per-node tax, the same manifests. |
| Managed Postgres: RDS, Cloud SQL | Postgres run by an operator inside the cluster, with daily off-site backups that are restored on a schedule to prove they work. |
| Vercel, Netlify and other front-end hosts | Your front end on your own cluster behind Cloudflare, or a free static host where the site is static. No bandwidth or seat charges. |
| AWS Secrets Manager, GCP Secret Manager, hosted vaults | External Secrets Operator reading a free parameter store or a vault you run. Secrets never enter git, an image or a command line. |
| Hosted IaC runners: Terraform Cloud, Spacelift, env0 | Plans and applies as CI jobs on your own runners, with state in a bucket you own. No per-resource or per-seat pricing. |
| GitHub-hosted and other cloud CI runners | Runners inside your cluster that scale to zero, with private access to the systems they build and deploy. |
| CloudWatch, Datadog | Prometheus, Grafana and Loki with alerts to Slack. Retention you choose, no per-host fee. |
| Load balancers, NAT gateways, public IPs | Cloudflare in front and a private network behind. No inbound ports open on your machines. |
Some things stay in the cloud: off-site backups in object storage, DNS and the CDN, and anything a regulator or a customer contract pins there. A cloud exit is about the bill and the control, not ideology.
How the security is kept
- GitOps. Everything running is described in a repository and reconciled by ArgoCD. Rebuilding from zero is a written procedure, not archaeology.
- Secrets. Pulled at runtime through External Secrets Operator. Nothing in git, nothing in an image, nothing on a command line.
- Network. Default-deny network policies, an egress proxy with an allowlist per workload, and no inbound ports: traffic arrives through Cloudflare and a private mesh.
- Workloads. Restricted pod security: non-root, read-only filesystems, no capabilities, no service-account tokens unless a workload needs one.
- Backups. Daily, encrypted, off-site, and restored into a scratch environment on a schedule. A backup nobody has restored is a hope.
- Observability. Metrics, logs and alerts from day one, so the first sign of trouble is a page, not a customer.
How an engagement runs
- Assessment, fixed fee. We read your bill and your architecture and write up what can move, what should stay, the expected monthly saving, and the risks. You keep the report whatever you decide.
- Migration, in stages. One service at a time, with a rollback path at each step and the old system left running until the new one has earned trust.
- Handover, or a retainer. Your team runs it with the runbooks we wrote together, or we keep operating it for a monthly fee.
Where this comes from
We run our own products this way: Kubernetes on hardware we own and on a small VPS, Postgres operated in-cluster with restored backups, CI runners inside the cluster, secrets through External Secrets Operator, and Cloudflare in front of all of it. The trade-offs on this page are ones we live with every day.
Start
Email [email protected] with a sentence about what you run and roughly what it costs each month. We reply with questions and a fixed fee for the assessment.