Cloud & DevOps Company in Ho Chi Minh City

We quote fixed-fee in VND or USD rather than publishing bands, hold the FPT Cloud and AWS ap-southeast-1 cost forecast as part of the proposal, and include a four-week post-go-live hypercare period in the base scope rather than billing it separately. A scoped HCMC cloud migration for a mid-market retailer or fintech is a three to six month engagement covering discovery, target architecture, IaC modules, CI/CD setup, observability, and a documented cutover with rollback. Bank-grade migrations under SBV Circular 09 cost more because they include OT consideration, SBV inspection-ready documentation, and a parallel-run period. Manufacturing IoT-to-cloud builds for HCMC headquarters with plants in Binh Duong or Bac Ninh are priced against the number of edge sites and the PLC and SCADA integration depth.

Not entirely, but for some categories yes. The 2018 Cybersecurity Law Article 26 and Decree 53/2022 require local storage in Vietnam for personal data of Vietnamese users, data generated by users in Vietnam, and important data when the operator is a foreign service provider in telecommunications, eCommerce, online payment, social networking, content, or messaging. SBV-regulated financial institutions face additional Circular 09 obligations. In practice our HCMC architectures run hybrid: hot production data and personal data inside FPT Smart Cloud or Viettel IDC, analytical workloads and DR on AWS ap-southeast-1 in Singapore, and a data classification policy that names the line. FPT Cloud has the most mature Kubernetes and DevOps tooling among Vietnamese providers in our experience. Viettel IDC is the strongest fit when the customer is SBV-regulated and already has a Viettel relationship. VNPT IDC handles state-sector adjacent loads. CMC Cloud is the value option.

SBV Circular 09/2020/TT-NHNN on IT risk management covers Vietnamese credit institutions and intermediary payment service providers comprehensively, with explicit treatment of cloud and outsourcing. Practically, the controls we have to satisfy include cloud service provider due diligence (we keep an SBV-ready vendor file for AWS, FPT Cloud, and Viettel IDC), data classification with sensitivity tiers, encryption at rest and in transit with documented key management, segregation of production and non-production environments, change-management approval gates, third-party access logging, business continuity with documented RPO and RTO targets, and inspection-ready audit logs retained for periods specified per data category. For SBV-licensed clients we deliver an architecture document and an operations runbook formatted for the SBV IT Department inspection cycle, plus a tabletop exercise per year demonstrating the failover from AWS ap-southeast-1 to FPT Cloud Hanoi as the alternative region.

We run both, and we run them differently. EKS on AWS ap-southeast-1 is our default for the cross-border tier and for workloads that need the AWS service catalog depth (RDS, ElastiCache, Aurora, SageMaker, Bedrock, MSK). FPT Cloud Kubernetes runs OpenStack-Magnum-derived clusters with the FPT proprietary console plus standard kubectl access, and we typically use it for the Vietnam-resident workloads that touch regulated data. Karpenter and Cluster Autoscaler handle node-pool scaling on AWS; FPT Cloud autoscaling is less mature so we provision capacity ahead of the December and January Tet retail spike. ArgoCD or Flux handles GitOps on both. Service mesh is Istio or Linkerd on AWS, simpler ingress on FPT for cost reasons. Cross-cluster connectivity uses AWS Direct Connect or Site-to-Site VPN to Vietnam, with FPT Cloud Direct Connect as a managed alternative when the partnership terms work.

Our default HCMC DR pattern is multi-region active-passive with a documented RPO and RTO per data tier. Hyperscale production runs in AWS ap-southeast-1 (Singapore) with synchronous DB replication for Tier-0 data; warm DR runs in ap-southeast-2 (Sydney) or ap-east-1 (Hong Kong) with hourly snapshots. The Vietnam-resident tier on FPT Cloud or Viettel IDC has its own DR setup, usually across two FPT regions (Hanoi and HCMC) or a Viettel primary plus an FPT secondary depending on commercial terms. We run quarterly DR drills with a written playbook and a Vietnamese-language operations runbook, simulating an AWS Singapore degradation against the Vietnamese sovereign tier and an FPT Cloud regional outage against AWS. The drill output goes to your CISO, your SBV liaison if applicable, and your parent company audit. Most HCMC operators we onboard had not run an actual DR drill in the prior 18 months.

SBV-regulated CI/CD has specific requirements that diverge from generic DevOps. We run GitHub Actions, GitLab CI, or Bitbucket Pipelines depending on the customer's source control choice, with mandatory two-person code review gates, segregation of build, deployment, and production-access roles, signed artifacts (Sigstore or Notary), and image scanning (Trivy or Snyk) at every push. Deployments to SBV-regulated production environments require a documented change-management ticket and an approval gate, and the pipeline logs feed the audit retention store inside Vietnam. Secrets management uses HashiCorp Vault, AWS Secrets Manager, or FPT Cloud Vault, never inline in pipeline YAML. We deliver the SBV inspection-ready deployment-history evidence as part of the operations runbook. For non-regulated HCMC clients (eCommerce, gaming, consumer) the pipeline is faster and less gated.

Yes, and this is one of our denser HCMC specialties. The pattern is consistent across Samsung Vietnam, Foxconn Vietnam, Intel Products Vietnam, and the mid-market export manufacturers around Binh Duong and Long An: PLCs and SCADA at the plant, an OT-IT segmentation layer with Purdue model boundaries, an edge gateway running AWS IoT Greengrass or Azure IoT Edge, MQTT or AMQP transport to a Vietnamese cloud landing zone, and analytics in the HCMC headquarters cloud account. We handle the segmentation, the certificate rotation, the firmware update channel, the cloud landing-zone IaC, and the dashboards in Vietnamese and English. Where worker telemetry constitutes personal data (badge access, attendance, productivity scoring) we observe Decree 13 and Vietnamese labor law on monitoring, with consent flows and works-council disclosure where the plant is unionized. Data egress costs to AWS Singapore are tracked monthly because manufacturing telemetry volumes surprise finance teams quickly.

Vietnamese eCommerce traffic is highly non-uniform. Daily peak runs 19:00 to 23:00 ICT, weekly peak is Friday evening through Sunday, and the annual peaks are the December 12 sale, the Black Friday equivalent in late November, and the pre-Tet window (typically late January to early February depending on the lunar calendar). We size our Karpenter and Cluster Autoscaler policies against the daily curve, reserve baseline capacity through AWS Savings Plans or FPT Cloud committed-use contracts for the Friday-Sunday floor, and pre-warm capacity 90 minutes before the December and Tet spikes. CloudFront and CloudFlare caching is tuned aggressively because Vietnamese broadband and 4G mix tolerates cached responses well. Database read replicas scale ahead of campaign launches. We deliver the cost forecast and the actual versus forecast variance monthly, with the variance broken down by service and by AWS account or FPT Cloud project. HCMC retail finance teams generally want VND-denominated forecasts even when the underlying invoice is USD, and we provide both.