Designed and built in-house

Solutions We've Engineered — the missing pieces, built

When a platform stops short of what a customer needs, we build the missing piece. This is a selection of the software we have designed and shipped ourselves. Several are deployed at customers today; others are productised platforms and connectors we extend per engagement.

Identity & Privileged Access Certificates & PKI AI, Agents & Compliance Business Automation
20+
Solutions Built In-House
4
Solution Families
9
Domains Served
On-Prem
If Your Data Demands It
Identity & Privileged Access

Identity, Privileged Access & Access Governance

Controlling who can reach what — including the applications, accounts and edge cases the major platforms leave uncovered.

Single sign-on

Single Sign-On for SAP GUI

The gap

SAP GUI is a thick client with no support for modern sign-on protocols, so it sits outside the enterprise identity portal — with its own passwords and no MFA.

What we built

Brings SAP GUI under portal single sign-on. Users launch SAP from the identity portal and are signed straight in, with no change to SAP itself.

  • Two-level authentication, encrypted end to end
  • Hardened, tamper-protected endpoint component
  • Central licensing across the estate
Built for: Enterprises running SAP behind an identity portal
Shared accounts

Shared Web Account Management

The gap

Teams share a handful of logins to third-party websites. Nobody knows who is using which account, and two people on one login lock each other out.

What we built

Signs users in to shared web accounts automatically and arbitrates the pool centrally, so one account is never in use by two people at once.

  • Automatic sign-in, with MFA handed back to the user
  • Central registry of who holds which account
  • Accounts released automatically on idle or crash
Built for: Teams that share logins to third-party portals
Privileged access

Privileged Access Discovery & Onboarding

The gap

Cloud identities and the machines they can reach change every day. Privileged access onboarding done by hand never catches up.

What we built

Continuously discovers cloud directory accounts and the virtual machines they can reach, and reflects them into your privileged access platform automatically.

  • Safes, privileged accounts and target machines provisioned for you
  • Access granted and revoked as directory group membership changes
  • Per-user entitlements kept continuously in sync
Built for: Large, fast-changing cloud estates
Access reviews

Dormant Access Review

The gap

Access reviews bury reviewers in entitlements, most of them in daily use. The dormant ones — the real risk — get approved along with the rest.

What we built

Works out each user’s genuine last use of every privileged entitlement, applies your inactivity policy, and sends only the dormant memberships for review.

  • Last-access evidence derived from real platform activity
  • Reviewer decisions executed automatically, revokes included
  • Reconciliation report ready for the auditor
Built for: Regulated enterprises with periodic access certification
Location-based access

Geo-Fenced Access Control

The gap

Some work must only happen from approved premises. Network-based location checks are easy to spoof and prove little to an auditor.

What we built

Geo-fenced access control for the identity portal: sign-in is blocked outside a permitted radius, and the session is revoked if the device leaves mid-session.

  • Location proof backed by the device’s own hardware
  • Checked throughout the session, not only at logon
  • Extends the identity portal you already run
Built for: Work that must be tied to a physical location
Legacy applications

Single Sign-On for Legacy Applications

The gap

In-house web applications that authenticate against a directory cannot join single sign-on without a rewrite nobody will fund.

What we built

Adds a standards-based sign-on layer in front of the application, and the matching trust on the identity provider, bringing it under portal SSO.

  • No rewrite of the application
  • No change to where credentials live
  • Standards-based, for enterprise identity platforms
Built for: Applications too critical to rewrite, too old for modern protocols
Certificates & PKI

Certificate Lifecycle & PKI Automation

Nothing expires unnoticed — and nothing waits on a person to request, approve, renew or install it.

Endpoint delivery

Last-Mile Certificate Installation

The gap

Certificate platforms issue and renew, but often stop short of installing the certificate on the machine that needs it. That last mile stays manual — and that is where outages begin.

What we built

Installs issued and renewed certificates onto Windows and macOS targets automatically, from inside your own network.

  • Closes the gap between renewal and installation
  • Runs on edge nodes inside the customer network
  • Plugs into the certificate platform you already have
Built for: Estates with large Windows and macOS footprints
Governed change

Certificate Renewal through the Service Desk

The gap

A certificate is about to expire. Who owns it, and who approves the change? In most estates the answer lives in someone’s inbox.

What we built

Bridges your certificate lifecycle platform and your IT service-management tool, so every renewal runs as a governed, ticketed change.

  • Discovery with owner mapping from the CMDB
  • Expiry notices to the real owner, change requests with dual approval
  • Renewal through to ticket closure, auditable per certificate
Built for: Enterprises where every change needs a ticket and an approver
Self-service

Self-Service Certificate Portal

The gap

Requesting a certificate means emails, spreadsheets and waiting on the PKI team.

What we built

A self-service web portal for certificate request and renewal, across cloud and on-premise certificate authorities.

  • One portal over multiple certificate authorities
  • Directory-integrated sign-in and approval history
  • Full issuance audit trail
Built for: Application and infrastructure teams who need certificates on demand
Extended coverage

Custom Certificate Connectors

The gap

Your certificate platform covers most of your estate. The rest — the load balancer or appliance outside standard vendor coverage — is still renewed by hand.

What we built

We build connectors for the targets your platform does not cover, to the platform’s own connector framework.

  • Delivered for a cloud load-balancer estate outside standard coverage
  • Built to the platform’s own framework, not around it
  • Extended per engagement as the estate changes
Built for: Estates with targets the platform vendor does not support
AI, Agents & Compliance

AI, Agents & Compliance

AI put safely to work in regulated businesses — and compliance systems for data that is not permitted to leave the building.

Agent security

Secure Human-in-the-Loop AI Agents

The gap

An AI agent that can act on real systems is a new kind of privileged user. Most are handed standing credentials and trusted to behave.

What we built

A working reference architecture for agents that touch real systems: each one proves its identity, is bound by policy to what it may do, and keeps a human in the loop.

  • Agent identity verified before it starts
  • Access issued just-in-time for the action in hand, never stored
  • Tamper-evident audit record of everything the agent did
Built for: Regulated businesses putting AI agents to work
Agentic web

AI Agent Identity & Control Layer

The gap

AI agents are arriving on company websites, APIs and payment rails. Most sites cannot tell a customer’s shopping agent from a scraper.

What we built

An India-native identity, intent and control layer: for everything touching your site or API, establish who operates it, whether its identity is real, and what it intends.

  • Allow, limit, challenge or block — in real time
  • Designed around ONDC, UPI agent mandates and DPDP
  • Consent and audit records ready for export
Built for: Indian web estates preparing for agent traffic
Asset management

Investment Guideline Compliance

The gap

Investment guidelines sit scattered across documents and systems. Which rule applies — and which version applied on a given date — becomes a research project.

What we built

Integrated compliance for asset management: one source of truth for investment guidelines and mandate rules.

  • Rules versioned over time, with precedence resolved
  • Full audit log of every change
  • Single-tenant and on-premise — mandate data never leaves you
Built for: Asset and fund managers
Business Automation

Business Automation for SMEs & Professional Services

The accounting and warehouse grind, automated — for growing businesses and the Chartered Accountants who serve them.

AI accounting automation

Automated Voucher Posting for CA Practices

The gap

Every month, Chartered Accountant practices re-key client invoices and bank statements into Tally, company by company.

What we built

Reads invoices and bank statements in whatever form they arrive and posts the vouchers into Tally automatically — across every client company, from one place.

  • Photos, PDFs, spreadsheets and CSVs
  • Clients submit documents from their phone
  • Automated reminders chase what is missing
Built for: Chartered Accountant practices
Inventory & warehouse

Barcode & Warehouse Workflows for Tally

The gap

Tally runs the books, but the warehouse runs on barcodes, batches and labels — and the two are reconciled by hand.

What we built

A desktop application that puts barcode, batch and warehouse workflows right next to Tally.

  • Scanning, label printing, goods receipt and voucher creation
  • GS1 and pharma batch handling
  • Works offline, with no cloud in the data path
Built for: Distributors, retailers and manufacturers on Tally
Android app

Mobile Companion for Warehouse & Sales Teams

The gap

The owner and the sales team are rarely at the desk where the accounting system lives.

What we built

The phone companion to our barcode and warehouse solution: scanning, dashboards, voucher actions and approvals from a phone.

  • Photo attachments on vouchers
  • Sales-rep flows and approvals
  • Pairs over your local network — business data never crosses our servers
Built for: Business owners and field sales teams
How We Build

A way of working, not a technology stack

The same engineering discipline runs through every solution on this page — whatever the domain.

  1. 01

    Design first, and the design is the contract

    Every solution begins with a high-level design you review before we build. Decision logs record what was chosen and why — including what we rejected.

  2. 02

    On-premise and single-tenant where the data demands it

    When information is confidential, regulated or market-sensitive, it stays inside your estate. We build for that case first rather than retrofitting it.

  3. 03

    Enforceable controls only

    We will tell you when a control can be spoofed or bypassed and propose one that cannot, rather than shipping a check that merely looks like enforcement.

  4. 04

    Shipped, not demoed

    Installers, licensing, updates, admin runbooks, UAT plans and handover documentation are part of the deliverable, not a later phase.

  5. 05

    Proven patterns, reused

    Building blocks proven in one solution carry into the next — which is why new solutions reach production quickly.

See a solution in action

If we have already built the piece you are missing, we will walk you through it. If we have not, we will design it with you.

Request a Walkthrough