Cloud & DevOps Company in Edinburgh

Evidence packs are the hidden weight in Edinburgh platform work for regulated firms. A scoped AWS or Azure landing zone build for a regulated Edinburgh financial services firm is an eight to twelve week engagement covering multi-account or multi-subscription separation, identity federation, network segmentation, an encryption baseline, logging and SIEM integration, and an FCA SS1/21 and PRA SS2/21 evidence pack. A Kubernetes platform build (EKS or AKS, GitOps with Argo CD or Flux, progressive delivery, observability) runs three to five months. A 12-month managed platform engineering programme covers infrastructure-as-code custody, on-call rotations bridging GMT and CT, monthly game days, FinOps reviews, and quarterly board reporting. Edinburgh sits roughly 15 to 25 percent below London while drawing from a deep platform engineering pool through University of Edinburgh Informatics and FNZ. We give fixed-fee proposals, not open T and M.

The Financial Services and Markets Act 2023 created the Critical Third Party (CTP) regime, giving the Bank of England, FCA, and PRA direct oversight over the systemically important third parties that UK financial services depend on. AWS, Microsoft Azure, Google Cloud, and several SaaS providers are expected to be designated in early waves. For Edinburgh firms, the CTP regime does not remove the firm's own SS2/21 outsourcing obligations, it adds a parallel oversight layer. Our discovery phase produces a CTP exposure map (which workloads run where, which provider is single-source, which would need migration in a designated CTP failure scenario), an exit plan that PRA SS2/21 requires for each material outsourcing arrangement, and a stressed scenario tabletop with the SMCR accountable executive. For firms with concentration in AWS eu-west-2 we typically scope warm standby or active-active across Azure UK South or a second AWS region depending on the important business service tolerance.

Yes. SS1/21 (FCA) and SS2/21 (PRA) are the operational resilience and outsourcing supervisory statements that have reshaped UK financial services since the March 2022 implementation. We start every engagement with a mapping of important business services, set tolerance for disruption with the SMCR accountable executive, identify single points of failure across cloud regions, network, identity, and key SaaS dependencies (Salesforce, ServiceNow, Workday, Microsoft 365), and run severe but plausible disruption scenarios. The cloud platform is then engineered to the tolerance, not to a generic four-nines target. Evidence flows into the firm's resilience register and the FCA's expected supervisory engagement. For NatWest Group, abrdn, Phoenix Group, Aegon UK, and Scottish Widows scale firms we have patterned this work after publicly disclosed operational resilience self-assessments and the PRA's published thematic findings.

We default to AWS eu-west-2 (London) and Azure UK South (London) for storage, compute, and inference. Where regulated firms require geographic redundancy without leaving the United Kingdom, Azure UK West (Cardiff) is the paired region for Azure UK South, and AWS Local Zones in Manchester provide low-latency edge for select workloads while keeping data in UK regions. For LLMs and AI workloads that must stay in the United Kingdom (FCA dual-regulated, ICO high-risk processing) we use Cohere's UK endpoints or self-host Llama 3 or Mistral on UK GPU instances. Cross-border processing into EU is acceptable when a UK GDPR transfer assessment signs off (the UK-EU adequacy decision continues to apply at time of writing). Cross-border into US requires a Transfer Risk Assessment under the UK Addendum to the EU Standard Contractual Clauses or the UK-US Data Bridge. We document residency in the architecture decision record and the data processing agreement so ICO, FCA, and PRA auditors have a clear answer.

Yes. Our Edmonton and Chandigarh hubs sit five hours behind Edinburgh and four and a half hours ahead respectively, which gives a natural follow-the-sun rotation. Edinburgh-headquartered firms typically place primary on-call with our UK-aligned engineers during business hours, with Chandigarh covering 22:00 to 06:00 GMT and Edmonton covering 06:00 to 14:00 GMT on weekends. For FCA SS1/21 important business services with sub-hour disruption tolerance we run primary and secondary on-call simultaneously with documented handoff against an Incident Commander rotation. Runbooks live in the firm's existing IT service management platform (ServiceNow, Jira Service Management, BMC Helix) and post-incident reviews are scheduled inside the firm's lessons-learned cycle the FCA expects.

When a project requires genuine research (novel distributed systems work, formal verification of critical paths, applied performance engineering on emerging hardware), we scope collaborations with University of Edinburgh Informatics systems and computer architecture researchers, the Bayes Centre on Potterrow, or Heriot-Watt rather than overselling in-house capability. Our core team handles applied engineering, platform engineering, SRE, FinOps, and operational resilience evidence work, which is where most Edinburgh cloud programmes actually stall. For standard work (landing zones, Kubernetes platforms, GitOps, observability, FinOps, disaster recovery) no academic partner is needed. We will tell you up front which bucket your problem fits into, and we have introduced Edinburgh clients to Edinburgh Innovations (the University's commercialisation arm) when it fits their roadmap.

A full migration for an Edinburgh pensions provider (Phoenix Group, Aegon UK, Scottish Widows style) or platform fintech (FNZ style) takes eighteen to thirty months from kickoff to a steady-state operating model, assuming a co-existence strategy rather than a hard cutover. Month 1 to 3 is discovery (application portfolio rationalisation, dependency mapping, important business service classification under FCA SS1/21, exit plan drafting under PRA SS2/21). Month 4 to 9 is foundation (landing zone, identity federation, network, encryption, logging, SIEM, disaster recovery baseline). Month 10 to 24 is wave-based migration with co-existence patterns through strangler fig architectures. Month 25 onward is rationalisation, decommissioning, and steady-state operations. The PRA's published thematic findings on cloud migrations consistently flag exit planning, concentration risk, and identity as the three failure modes, and we scope each of those as separate workstreams from day one.

Some custom cloud and DevOps work qualifies under the United Kingdom's R&D tax relief regime. From April 2024 the merged R&D Expenditure Credit (RDEC) scheme gives a 20 percent above-the-line credit (net roughly 15 percent after tax) for most companies, with a higher Enhanced R&D Intensive Support (ERIS) rate of 27 percent net for loss-making R&D intensive SMEs. Eligible activity generally includes novel distributed systems work, custom Kubernetes operators that resolve genuine technical uncertainty, performance engineering on emerging hardware, and applied research integration, not routine landing zone builds or off-the-shelf observability deployment. We deliver time-tracked logs, technical narratives, and failed-hypothesis documentation aligned with HMRC CT600 and the Additional Information Form mandatory since August 2023. Scottish firms can layer Scottish Enterprise R&D grants on top. Final eligibility sits with your R&D tax adviser and HMRC.