Cloud & DevOps Company in Lisbon

Cloud work in Lisbon is quoted per phase, and the regulatory tier moves the last one: a landing-zone build on AWS Control Tower or Azure Management Groups, including network design, identity federation with Entra ID or AWS IAM Identity Center, and baseline CIS-benchmark guardrails, a production Kubernetes platform with GitOps, observability, and a tested disaster-recovery plan, or ongoing managed cloud operations scoped against environment count, on-call coverage, and the regulatory tier (NIS2 essential entities pay more for documented incident response). Pricing is fixed-fee in EUR, billed monthly against a written scope rather than open time-and-materials, and we have signed comparable terms with both VW Digital Services-adjacent suppliers and Portuguese fintech challengers.

There is no AWS region in Portugal yet, so the practical options are eu-west-1 Dublin (lowest latency to Lisbon at roughly 35 to 40 ms, broadest service catalogue, default for most Portuguese SaaS companies), eu-west-3 Paris (useful when a French parent like Natixis or BNP requires CNIL alignment), and eu-south-2 Spain in Aragon, which opened in late 2022 and offers the lowest physical latency to Lisbon at roughly 20 ms with full EU data residency. For workloads under CNPD review or NIS2 obligations, we usually pair eu-west-1 as primary with eu-south-2 as DR, both AWS European Sovereign Cloud-eligible. Azure West Europe Amsterdam and Germany West Central Frankfurt are common alternatives when the client already runs on Microsoft 365 or has a German parent requiring Bundesdatenschutzgesetz alignment.

Yes. NIS2 took effect across the EU in October 2024 and Portugal transposed it through the Centro Nacional de Cibersegurança (CNCS). For essential entities (energy, transport, banking, financial market infrastructures, health, drinking water, digital infrastructure) and important entities (postal, waste management, food, manufacturing of critical products, digital providers), the obligations include 24-hour early-warning incident reporting, 72-hour full notification, supply-chain risk management, and management-body accountability. We map each control to your existing AWS or Azure landing zone, add the missing logging (CloudTrail Lake, Azure Activity Logs into a Sentinel workspace), wire up the CNCS-reporting workflow, and produce the documented evidence the supervisor will ask for. We do not certify NIS2 — Portuguese supervisors do — but our deliverables have passed both internal audit at Lisbon-based banks and external NIS2 readiness reviews by Big Four advisories.

Both. Codazz has its New York office and a Chandigarh delivery hub, and we staff Lisbon accounts with engineers who cover the full CET working day live (09:00 to 18:00 Lisbon time) from Chandigarh, where a four-and-a-half-hour offset puts them on duty from 13:30 to 22:30 IST. Standups, architecture reviews, incident war-rooms, and platform demos happen in real time with Lisbon product, security, and compliance leads in Parque das Nações, Marquês de Pombal, or the Hub Criativo do Beato. Overnight, the Chandigarh team continues build, test, and deploy work so the Lisbon office wakes up to a moved-forward pipeline. We do not bill for handoff time and we do not run a follow-the-sun model that drops context every twelve hours.

Every Lisbon cloud build ships with a CNPD-aligned data flow diagram, an Article 30 record of processing activities for the platform components themselves (not just the application), and a Data Processing Agreement template aligned with the EU Commission's Standard Contractual Clauses where any sub-processor sits outside the EEA. We pin storage and compute to EU regions by default (eu-west-1, eu-west-3, eu-south-2, eu-central-1) with Service Control Policies on AWS Organizations or Azure Policy on management groups blocking deployments outside the approved residency set. Customer-managed encryption keys (AWS KMS with imported key material, Azure Key Vault HSM, GCP Cloud HSM) are the default for any data classified as personal under GDPR Article 4, and CloudTrail, Azure Activity Log, and GCP Audit Logs feed a SIEM with retention defaults tuned to CNPD guidance on record-keeping.

A representative Lisbon Kubernetes migration runs sixteen to twenty-four weeks. Weeks 1 to 4 cover discovery: workload inventory, dependency mapping, current pain points, and a landing-zone gap analysis against AWS Well-Architected or Azure CAF. Weeks 5 to 10 build the target platform — EKS or AKS clusters across two regions, Karpenter or Cluster Autoscaler for node management, Cilium for networking with network policies generated from observed flow logs, ArgoCD for GitOps, External Secrets Operator pulling from Vault or AWS Secrets Manager, and the observability stack. Weeks 11 to 18 migrate workloads in waves, starting with non-production services to prove the pipeline, then production behind a documented cutover plan. Weeks 19 to 24 cover hardening, FinOps reviews, chaos-engineering rehearsal, and the NIS2 incident-response runbook. We have shipped this pattern for both regulated (banking) and product (SaaS) clients in Lisbon.

FinOps for Lisbon SaaS companies generally starts with three weeks of read-only access to AWS Cost Explorer, Azure Cost Management, or GCP Billing, plus the workload telemetry we already collect through the platform. We typically find 20 to 35 percent savings in the first pass through Savings Plans or Reserved Instances on baseline compute, Spot or Azure Spot on stateless workers, S3 Intelligent-Tiering or Azure Blob lifecycle policies on cold data, right-sizing of over-provisioned RDS or Azure SQL instances, and removal of orphaned EBS volumes, idle load balancers, and untagged resources that nobody owns. We then wire FinOps Foundation-aligned dashboards (showback per team, unit economics per tenant) and quarterly cost-review cadence into the GitOps workflow. The first review is fixed-fee, and we have done this for Lisbon SaaS clients where the OutSystems-style PaaS spend was the dominant cost line.

Yes. The Digital Operational Resilience Act came into force on 17 January 2025 and binds banks, investment firms, payment institutions, and crypto-asset service providers operating in Lisbon — including BNP Paribas IT, Natixis, Revolut Lisbon, and the local treasury operations of the major Iberian banks. Our DORA-relevant cloud work covers ICT third-party risk mapping (every AWS or Azure service treated as a critical ICT third-party where the workload supports a critical function), the contractual clauses required by Article 30, threat-led penetration testing (TLPT) coordination with the supervisor, and incident classification logic wired into the existing SIEM. Banco de Portugal and ESMA expect documented evidence, not slides, and our deliverables (architecture decision records, runbooks, evidence packs) have survived parent-company internal-audit review at French and Dutch banking groups.