Cloud & DevOps Company in Halifax

We work fixed-fee from our Edmonton and Chandigarh hubs on Atlantic and Eastern hours, scoped per engagement rather than published as bands. A focused landing-zone build (AWS Control Tower or Azure Landing Zones with Terraform, identity, logging, baseline security, and one or two workload environments) is a six to ten week engagement. A full multi-account or multi-subscription enterprise landing zone adds Kubernetes platform engineering, GitOps deployment, observability, secrets management, and FinOps tooling over fourteen to twenty-two weeks. Managed DevOps retainers are scoped against Kubernetes platform complexity, on-call coverage, and SOC 2 evidence requirements. Defence and ocean-data scale engagements (petabyte-scale data platforms, ITAR-aware architecture, Protected B suitability) scope at the higher end because of documentation overhead. ACOA-funded clients receive grant-reporting templates and milestone-aligned billing.

We default primary to AWS ca-central-1 (Montreal) or Azure Canada Central (Toronto), with DR pairing to AWS ca-west-1 (Calgary, launched November 2024) or Azure Canada East (Quebec City). The 2024 launch of AWS ca-west-1 was a major improvement for Atlantic Canada clients because previously the two AWS Canadian regions (ca-central-1 and the long-promised ca-west-1) collapsed into single-region risk; now you can run real geographic DR within Canada without crossing the border. Customer-managed keys (CMK) sit in Canadian KMS. Cross-border (us-east-1) is acceptable only when a Privacy Impact Assessment signs off, typically for non-sensitive internal tooling. For Protected B Crown workloads we use GC Cloud where procurement requires it. Nova Scotia FOIPOP and PIPEDA documentation captures residency, encryption, and key-management posture in writing.

We work with defence-adjacent suppliers operating in unclassified and Protected A or B environments — shipyard subcontractors, IMP Aerospace MRO suppliers, Lockheed Martin Atlantic subcontractors, dual-use research at Dalhousie and DRDC Atlantic. We do not hold Top Secret clearance in-house; for Secret and above we coordinate through cleared partner firms while running unclassified cloud architecture, CI/CD, and Kubernetes platform work ourselves. Baselines map to CCCS Top 10, ITSG-33 Annex 3 Protected B profiles, and NIST 800-171 derivative requirements for US DoD-bound subcontracts. Controlled Goods Program registration touchpoints are flagged in discovery rather than after a procurement halt. AWS GovCloud and Azure Government are options when US-defence prime contracts require them, with the caveat that those regions are physically US-located and require an export control review.

Ocean data is a specific scientific computing problem: bursty ingestion (AUV missions, glider deployments, NEPTUNE-equivalent cable observatories on the Atlantic side), petabyte-scale archival, and analytical workloads that mix structured query, geospatial (PostGIS, BigQuery GIS), and ML (oceanographic anomaly detection, marine species identification on hydroacoustic data, sea-state forecasting). We build on AWS S3 with intelligent tiering and Glacier Deep Archive for cold data, Lake Formation or Databricks Unity Catalog for governance and lineage, Snowflake or Redshift for analytical query, and SageMaker or Azure ML for oceanographic ML. Compute uses AWS ParallelCluster or Azure Batch with Slurm for HPC workloads, and Spot Instances aggressively for batch jobs that tolerate interruption. We coordinate with Dalhousie's Institute for Big Data Analytics and DFO Maritimes' science computing teams when scope demands data-sharing agreements with federal scientific authorities.

Manulife operates Manulife Asset Management (John Hancock back-office) extensively from Halifax, and the federally regulated arms answer to OSFI Guideline B-13 (Technology and Cyber Risk Management, effective March 2024). For cloud and DevOps that means: documented governance of cloud service providers with formal third-party risk reviews; clear data classification and residency controls; defined identity and access management with privileged-access workflows; logging and monitoring sufficient for the OSFI Cyber Self-Assessment Tool; incident reporting playbooks aligned with OSFI's 24-hour material incident timeline; and resilience and continuity planning with documented RTO and RPO. We deliver landing zones with these controls baked in, plus B-13 evidence packages that map your cloud control catalogue to OSFI expectations, and we coordinate with internal audit and the Chief Risk Officer so the narrative survives external assurance and on-site OSFI review.

For Halifax-scale startups (typically pre-Series A through Series B, twenty to one hundred staff) we recommend managed Kubernetes (EKS, AKS, or GKE) rather than self-managed, with Karpenter or Cluster Autoscaler for node autoscaling, Argo CD for GitOps deployment, Helm or Kustomize for manifest templating, and a thin platform-engineering layer (often Crossplane or Terraform Cloud) for self-service provisioning. We default to EKS on AWS ca-central-1 because that gives the broadest CCCS-aligned tooling ecosystem and ACOA-funding-friendly cost predictability. AKS is the right choice when the team is .NET-heavy or already on Azure for Microsoft 365 integration. GKE is rare in Halifax but viable for data-heavy workloads using BigQuery. We avoid recommending bare Kubernetes (kubeadm-built clusters) for organizations under 200 engineers — the operational burden does not justify the marginal cost savings.

Yes, often. The Atlantic Canada Opportunities Agency (ACOA) funds technology adoption, scale-up infrastructure, and innovation through programs like the Regional Economic Growth through Innovation (REGI) stream, the Business Scale-Up and Productivity (BSP) stream, and the Innovative Communities Fund. Cloud platform builds and DevOps modernization often qualify under BSP for SMEs investing in productivity-enhancing technology. The Canadian Ocean Cluster also co-invests with members on technology projects. We deliver milestone-aligned billing, outcome reporting templates, and the supporting engineering documentation ACOA program officers expect (architecture diagrams, before-and-after cost analysis, capability uplift metrics, employment impact for Atlantic Canada). We are not an ACOA consultant — we coordinate with your grants consultant or in-house grants lead, but we structure the engagement to slot into ACOA reporting cadences cleanly. Federal SR&ED on eligible portions is also typically claimable.

Before November 2024, AWS Canadian DR was effectively single-region — ca-central-1 (Montreal) was your only practical Canadian option, and cross-border DR meant us-east-1 with Privacy Impact Assessment and contractual data-export reviews. The launch of ca-west-1 in Calgary in November 2024 finally gives Atlantic Canada clients real geographic separation within Canada: Montreal primary, Calgary DR, both inside Canadian residency boundaries. For Halifax workloads where Nova Scotia FOIPOP, PIPEDA, OSFI B-13, or Protected B requirements demand Canadian-only data, this is the meaningful change. We redesign DR plans to use ca-central-1 plus ca-west-1 as paired regions, Route 53 health checks for failover, S3 Cross-Region Replication, RDS or Aurora Global Database for low-RPO database DR, and EKS multi-region patterns where the workload justifies the operational complexity. Azure Canada Central plus Canada East already provided this pattern; AWS finally caught up. Expect another twelve to twenty-four months of regional service maturation before ca-west-1 has full parity with ca-central-1 on every service.