Standards & Methodology
Shared engineering principles for architecture, security and quality. Applicable requirements, responsibilities and acceptance criteria are agreed for each project.
How our work is organised
Competency-Driven Management
Project teams are engaged based on domain expertise, not hierarchy or resource availability. This eliminates the handoff effect between contractors.
Single Accountability Point
Each project has an agreed lead member company and client contact. The contractual model, SLA and reporting are defined around the participating teams and their responsibilities.
Shared Technology Foundation
UnityBase and other ecosystem platforms have their own architectures. Compatibility is established through agreed APIs and data contracts, identity management and integration checks.
Security by Design
Threat modelling, least privilege, data protection and recovery requirements inform architecture. Regulatory obligations depend on the data, sector, jurisdiction and each project participant’s role.
Standards & compliance
Standards, regulatory requirements and engineering practices serve different purposes. Applicability is documented per project; a company’s certification is established by a valid certificate and its scope.
ISO/IEC 27001:2022 covers information security management, risk assessment and controls for access, incidents and suppliers. Implementing controls and obtaining independent certification are separate steps.
NIS2 applies through EU Member States’ legislation to defined entities and sectors. Financial institutions additionally require assessment of DORA and ICT supplier obligations.
GDPR governs personal data. The Data Act separately addresses access to connected-product data and switching cloud providers. Access rights, portability and contractual terms inform architecture.
Access is evaluated using identity, device posture and request context. Least privilege, segmentation, MFA and workload identity controls complement network protection.
A secure lifecycle informed by NIST SSDF and OWASP ASVS 5.0 verification: code, dependency and secret analysis, SBOMs, artifact provenance and vulnerability remediation.
ISO 9001:2026 is the current quality management edition. Transition from the previous edition is planned with the certification body; each company’s status is checked separately.
AI risk management, accountability, data quality and human oversight. AI Act applicability depends on intended use and organisational role; ISO/IEC 42001 certification does not replace regulatory obligations.
For products within CRA scope: vulnerability handling, updates and assurance evidence. Reporting obligations apply from September 2026 and the main requirements from December 2027.
Security authorisation and integrated information protection systems (KSZI) under current and transitional procedures. Protection, cryptography and assurance requirements follow the information category and system.
Approaches to development
Scrum for iterative product work and Kanban for continuous flow. Cadence, work-in-progress limits, demonstrations and retrospectives are selected for the team’s context.
Automated builds, tests and security checks; small releases, controlled rollout and rollback. AI-assisted changes undergo the same checks and accountable review.
Model business domains, record decisions in ADRs and verify integration contracts. Select a modular monolith or microservices based on domain boundaries, scaling needs and operational readiness.
Terraform, Ansible and other IaC tools provide versioned environments. GitOps, policies and secrets have explicit controls; recovery is verified through exercises.
OpenTelemetry for metrics, logs and traces; SLIs/SLOs, error budgets, incident reviews and practical RPO/RTO verification.
Versioned models, prompts and evaluation sets; permission-aware RAG, prompt-injection checks, restricted tools, budgets and agent autonomy. Failures have a defined safe fallback.
Team self-service through verified templates, supported versions and transparent costs. Platform value is assessed through developer experience and service outcomes.
Service levels & support
Support is delivered by member companies. SLAs define availability measurement and response commitments; SLOs set reliability targets, RTO sets recovery time and RPO sets acceptable data loss. Values and responsibilities are contractual.
Standard tiers: Base (8×5, next business day), Standard (12×5, 4 hrs), Premium (24×7, 1 hr). For critical infrastructure a Mission Critical tier is available with a target recovery time under 15 min.
Let’s scope your project requirements
We’ll define the applicable standards, the accountability model and the SLA level before work begins.