Services
The list is short on purpose. Everything below is work we do ourselves — nothing here is subcontracted out and resold, and nothing is offered that we cannot stand behind afterwards.
Operational systems built around a problem that is costing you money, time or visibility — not a template bent to fit.
Scoped and quoted per project
Somebody has to own the server on Monday morning. Deployment, monitoring, backups, patching, and a report each month that says what happened.
Monthly retainer
A passive review of what your organisation exposes to the public internet, delivered as evidence with risk ratings — not opinion.
Fixed scope, fixed price
Fresh graduates working on real client systems that are going to production — under supervision, with every change reviewed before it ships.
By cohort · applications open
Hosting & managed care
Most systems do not fail at launch. They fail eighteen months later, when the certificate expired, the backup had been silently failing since March, and the person who set it up has moved on. These tiers exist so that does not happen to you.
For a site or small system that simply has to stay up.
On requestper month
Most chosen
For a system a team depends on during working hours.
On requestper month
For a system where a bad morning is a business problem.
On requestper month
Every tier is a written agreement with a named scope. Hosting region is agreed before deployment — where your data is allowed to live may be set by your regulator, not by us.
Security assessment
Scope is agreed in writing before anything begins. Everything below is observable from outside your organisation, using non-intrusive methods, and nothing is exploited.
You receive a written report: findings with evidence, risk ratings, practical remediation steps, items needing internal verification, and a prioritised plan. A passive assessment is a starting point — it does not replace a full penetration test, and we will tell you when you need one.
Graduate programme
Rwanda graduates capable engineers every year who have never seen a system with real users, real money and real consequences in it. We close that gap by putting them on ours — supervised, reviewed, and paid attention to.
This is a real part of how we work, not corporate social responsibility. A supervised graduate multiplies what we can build — but only when the work is consistent, reviewed and secure, which is why the programme is structured rather than ad hoc.
Selected work
Security assessment
A follow-up to an initial cybersecurity review that had flagged four areas as needing technical verification: email security, security headers, vulnerability management and banking cybersecurity controls.
We ran a passive, non-intrusive external assessment — SSL/TLS review, DNS email security checks, HTTP security header analysis, passive web application scanning, network reconnaissance and certificate transparency review — and delivered a written report with evidence, risk ratings, remediation steps and a prioritised plan.
The client is not named here. Engagement details are shared with prospective clients on request, with permission.
Questions
Moses Sebagabo, the founder, does the engineering. Supervised interns take on scoped work as the company grows, and every change they make is reviewed before it ships. You will be talking to the person building your system, not an account manager.
Yes, for development and assessment work. Hosting is a different question — where your data is allowed to live may be set by your regulator, not by us, so we agree the region before anything is deployed.
You do, for work commissioned and paid for as custom development. We keep ownership of our own general-purpose libraries and tooling, and we name those in the contract rather than leaving it vague. We do not reuse one client's business logic for another.
No. We build systems that record payment status, reconcile payments and report on arrears. Money settles through a licensed payment service provider — our partnership is with Centrika, and funds move on its licensed rail. We never take custody of funds.
Agreed with you before deployment, and written into the contract. Access is least-privilege: we hold only what is needed to run and support the system, access to production is logged, and we do not copy production data onto laptops or into third-party tools without your written approval.
On Essential, next-business-day email support — appropriate for a site that is not business-critical, and we say so rather than implying more. On Managed and Assured you get a named contact and a response time written into the contract. We commit to what we can meet: a promise of 24/7 cover that nobody actually answers is worth less than a stated window that always holds.
You are not locked in, by design. The code lives in a repository you own, or is handed to you on request. Every system ships with a written deployment runbook — how it is built, where it runs, what the environment variables are, how backups are taken and restored. Standard tools and no proprietary framework, so another engineer can pick it up. We would rather you never need any of that, but you should not have to trust us on it.
Tell us the numbers and we will answer honestly. The systems we build are multi-tenant and designed for thousands of records and concurrent users — that is an architecture question, not a headcount question. Where a project needs more hands than we have, we will say so before the contract rather than after, and we will not take it on the assumption that it works out.
Development is scoped and quoted per project, with a deposit at the start and the balance against agreed milestones. Assessments are fixed scope and fixed price. Hosting is a monthly retainer. We do not do unpaid customisation, and we would rather re-quote a changed scope than absorb it silently.
Often, yes. It starts with a paid review of what exists — the code, the server, the backups and whatever documentation there is — so we can tell you honestly whether it should be maintained, refactored or replaced. Nobody benefits from us guessing at that for free.
Next step
We would rather spend twenty minutes understanding the problem than send you a document that guesses at it. If we are the wrong people for the job, that is a useful outcome too.
