OJC

SaaS development · Security audits · AI · Cloud

Software, security and cloud. Done properly.

We build software products that hold up under real customers, find the security gaps in your cloud, Microsoft 365 and applications before someone else does, and put AI to work where it actually pays off. Senior engineers, plain answers, no hand-offs.

Start a conversation See what we do
  • Australian owned
  • Data hosted in Australia
  • You deal with the engineers

Security audit · example findings

  1. MappedCloud accounts, 38 public endpoints, Microsoft 365 tenant
  2. CriticalStorage bucket allowing public read of customer files
  3. HighMFA not enforced on three admin accounts
  4. MediumLegacy API still accepting TLS 1.0
  5. FixedBoth critical and high items closed the same day
An example of what an audit turns up: found, ranked by risk, explained in plain English and fixed.

Senior only

Every project is run and built by experienced engineers. No juniors learning on your budget.

Security first

We audit for a living, so everything we build gets the same scrutiny from day one.

Australian data

We host in Australian regions on AWS and Azure, and keep your data onshore.

Plain English

Clear scopes, honest timelines and reports that a board can read.

What we do

Four areas, closely linked. Most clients start with one and end up using two or three, because a product needs secure cloud underneath it and AI is only worth having if it is built and run properly.

  • SaaS development

    End-to-end product engineering, from the first sketch to thousands of paying users. We design, build, launch and keep improving multi-tenant software that stays fast, secure and affordable to run as it grows.

    • Product design, architecture and MVPs
    • Multi-tenant platforms with proper data separation
    • Billing, user management and single sign-on
    • APIs and integrations with the tools your customers use
    • Rescue and rebuild of existing products

  • Security audits

    Independent reviews of your applications, cloud, Microsoft 365 and processes. You get clear, ranked findings with the fix for each one, not a hundred-page PDF nobody reads.

    • Cloud configuration reviews for AWS and Azure
    • Microsoft 365 and identity security
    • Web application and API testing
    • ACSC Essential Eight maturity assessments
    • Retesting once fixes are in

  • AI

    Practical AI that takes real work off real people. We build features and internal tools on leading language models, wired into your systems, with your data kept private and a person in the loop where it matters.

    • Document reading, extraction and summaries
    • Search and Q&A over your own documents
    • AI features inside your product
    • Workflow automation with human review
    • AI usage policies and risk reviews

  • Cloud

    Cloud architecture, migration and cost control on AWS and Azure. Everything defined as code, deployed through proper pipelines and monitored, so environments are repeatable and nothing depends on one person's memory.

    • Architecture and landing zones
    • Migrations from on-premises or between clouds
    • Infrastructure as code and CI/CD pipelines
    • Cost reviews and right-sizing
    • Backups, monitoring and disaster recovery

Security audits, explained

Most breaches come from ordinary gaps: a setting left open, an account without MFA, a forgotten server. An audit finds them while they are still cheap to fix.

What we look at

Cloud
Identity and access, storage exposure, network rules, logging, encryption and backups across your AWS and Azure accounts.
Microsoft 365
MFA and conditional access, admin roles, email protection, external sharing and the settings attackers check first.
Applications
Authentication, authorisation, data handling and the common web and API weaknesses, tested the way an attacker would.
External surface
Everything you expose to the internet: domains, servers, open ports, certificates and forgotten test systems.
Process
Patching, backups, joiners and leavers, and incident response, measured against the ACSC Essential Eight.

What you get

  • A one-page summary for owners and boards
  • Every finding ranked by real-world risk
  • A plain-English explanation of why each one matters
  • The exact fix, step by step, for your team or ours
  • A walkthrough call to go through it together
  • A retest to confirm the fixes worked

Most audits take one to three weeks depending on scope. We agree a fixed price before we start.

Book an audit

AI that earns its place

AI is useful for some jobs and a liability for others. We start with the work your team does today and only use AI where it is faster, cheaper and reliable enough to trust.

Read the paperwork

Invoices, applications, contracts and forms read automatically, with the key details pulled into your systems and anything unclear sent to a person.

Answer from your own knowledge

Staff ask a question in plain English and get an answer drawn from your policies, manuals and past work, with links to the source.

Draft the first version

Replies, reports, quotes and summaries drafted in seconds for your team to check and send, so their time goes on judgement, not typing.

Smarter products

AI features inside your own software, such as search, recommendations and assistants, built to be reliable, measurable and affordable at scale.

Our ground rules for AI

  • Your data is never used to train public models
  • Sensitive data stays in Australian regions where possible
  • A person reviews anything that matters before it goes out
  • We measure accuracy before launch and keep measuring after

How we work

You deal with the people who do the work, from the first conversation to the support call years later.

  1. Understand

    We learn how your business works and what problem is worth solving before anyone writes code or runs a scan.

  2. Scope

    A clear written scope, timeline and price. You know exactly what you are getting before you commit.

  3. Deliver

    Working software early and often, or audit findings as we go. Short updates, no surprises at the end.

  4. Support

    We host, monitor, patch and improve what we build. When something needs attention, you talk to us directly.

Ways to work with us

Pick the shape that fits. Plenty of clients move between them as their needs change.

Fixed-scope project

A defined piece of work with an agreed price and timeline. Ideal for an MVP, a migration, a new feature or a security audit.

Ongoing partnership

A monthly arrangement for continuous development, hosting, monitoring and support. Your own engineering team, without the hiring.

Advisory

Senior technical advice when you need it: architecture reviews, vendor and tender assessments, due diligence and board briefings.

Technology we work with

  • AWS
  • Microsoft Azure
  • Microsoft 365
  • Entra ID
  • Terraform
  • Docker
  • TypeScript
  • Node.js
  • Python
  • PostgreSQL
  • GitHub Actions
  • Large language models

Common questions

Something else on your mind? Ask us directly.

How much does a project cost?

It depends on the scope, so we do not publish a price list. After a short conversation we give you a written fixed price for defined work, or a clear monthly rate for ongoing work. There is no charge for that first conversation.

How long does a security audit take?

Most audits take one to three weeks from kick-off to report, depending on how many cloud accounts, applications and users are in scope. Anything critical is reported to you as soon as we find it, not at the end.

Where is our data stored?

By default we host in Australian regions on AWS or Azure. If a service you need is only available offshore, we tell you up front and you decide.

Will you sign an NDA?

Yes. We are happy to sign a reasonable NDA before you share anything sensitive, and we treat everything you tell us as confidential either way.

Can you work with our existing developers or IT provider?

Yes. We often work alongside in-house teams and managed service providers, whether that is building a feature together, reviewing their work or giving them a second opinion on security.

Do you support what you build?

Yes. We host, monitor, back up and update the software we build, and you can reach the engineers who wrote it. Support is available as part of an ongoing partnership.

We already have software. Can you take it over?

Usually, yes. We start with a review of the code, hosting and security so you know exactly what you have, then agree a plan to stabilise and improve it.

Tell us what you need.

A few lines about what you are building, what is worrying you or what is slowing you down. We will tell you straight whether we can help and what it would take, usually within one business day.

Working with businesses across Australia, remotely or on site.