services
Four disciplines,one standard.
Every engagement is scoped in writing, delivered by senior engineers who have shipped the thing before, and run under the same security posture we sell. No juniors at senior rates, no black boxes.
LLM & AI Engineering
Engagements from £18k
AI strategy & roadmaps
Where AI actually pays off in your business — an evidence-based plan, not a slideware vision.
Custom fine-tuning
Domain-tuned open-weight and hosted models — data pipelines, training runs, and eval harnesses included.
RAG & knowledge systems
Retrieval architectures that answer from your data with citations, guardrails, and measurable accuracy.
Autonomous agents
Tool-using agents for operations, support, and research — sandboxed, observable, and auditable.
Model evaluation & safety
Eval suites, red-teaming, and regression gates so model changes never surprise production.
LLM application builds
Copilots, assistants, and AI features shipped end-to-end inside your product.
What you get
- ›Eval harness with scorecards wired into CI
- ›Architecture and data-flow documentation
- ›Runbooks and monitoring dashboards
- ›Clean handover — code, weights, and eval sets in your repos
Advanced Software Engineering
Engagements from £24k
Distributed systems
Event-driven backbones, consensus, and data pipelines that stay correct under load.
Performance engineering
Profiling and rewriting hot paths — 10× latency wins are the brief, not the surprise.
Managed security operations
Threat modeling, hardening, and monitored defenses for systems that face the internet.
DevOps & cloud automation
CI/CD, infrastructure-as-code, and cloud architecture that deploys itself and fails loudly.
Data engineering
Pipelines, warehouses, and streaming that stay correct and observable — with data contracts, tests, and lineage.
Legacy modernisation
Strangler-pattern migrations that de-risk decade-old codebases without a rewrite cliff.
What you get
- ›Architecture decision records for every major choice
- ›Test suites gating each change slice
- ›Performance reports with before/after numbers
- ›On-call and operations handover documentation
Security Services
Assessments from £6k
Penetration testing
Web app, API, network, and cloud pentests done by hand — not just a scanner — with findings ranked by real exploitability and a free retest of the fixes.
Red team engagements
Goal-based adversarial simulation — phishing, initial access, lateral movement, exfiltration — run safely against your live estate and fully logged.
Security audits & code review
Architecture and source review against a real threat model: auth, secrets, injection, and the business-logic flaws scanners never find.
Cloud security posture
CSPM and CNAPP reviews of AWS, GCP, and Azure — misconfigurations, over-broad IAM, exposed storage, and drift, prioritised by blast radius.
Incident response
Containment, forensics, and root-cause analysis when something has already gone wrong — plus a rehearsed plan so the next one is boring.
Compliance readiness
Cyber Essentials Plus, ISO 27001, SOC 2, and UK GDPR — controls built into the system and evidence collected as you go, not the week before the audit.
What you get
- ›Ranked findings report with proof-of-concept exploits
- ›Remediation guidance and a free retest
- ›Executive summary for the board
- ›Attestation letter for your customers
Managed Infrastructure & SRE
Managed from £2.4k/mo
Cloud & platform engineering
Internal developer platforms, golden paths, and infrastructure-as-code your teams actually want to use.
Managed Kubernetes
Production clusters we operate — patched control plane, autoscaling, cost kept honest — or a simpler platform when Kubernetes is overkill.
Database operations
Postgres, MySQL, and Redis tuned, backed up, and failed over, with point-in-time recovery you have actually tested.
Observability & SRE
SLOs tied to user experience, error budgets, and alerting on symptoms — so incidents are found before your customers find them.
Monitoring & on-call
24/7 detection with engineers on the pager and a rehearsed incident plan, not a dashboard nobody watches.
Backup & disaster recovery
Automated offsite backups, tested restores, and a recovery plan with a real RTO and RPO — not a hope.
What you get
- ›Runbooks and an on-call rotation set up
- ›Per-team cost dashboards
- ›SLOs and error budgets agreed and monitored
- ›Tested restores with a documented recovery plan
engagement models
Fixed scope
A written proposal with milestones, acceptance criteria, and a fixed price. Best for bounded builds, audits, and migrations.
Retained team
Senior engineers embedded with your team month to month, with a named lead and weekly demos. Best for ongoing product work.
Build & host
We build the system, then run it on Nintech infrastructure under the SLAs on the hosting page. One accountable partner, end to end.
estimate your engagement
Consultancy estimator
A ballpark in thirty seconds, priced the way we actually work. The real number comes from a scoping call and a written proposal — this just sets expectations.
What do you need?
Engagement
Complexity
Well-understood problem, clean data.
Estimated project cost
£7,900 – £10,600
Includes scoping, a written proposal, and a fixed price against agreed acceptance criteria.
Indicative only. Your exact figure comes from a written proposal after a scoping call — no charge, no obligation.
Everything above is what we deliver. This is how we hold ourselves.
The controls, encryption, and response discipline behind every engagement and every hosted system — written for the people whose job is to check.
advanced capabilities
The methods a modern attacker actually runs into.
Zero Trust architecture
Every request is authenticated and authorised on its own merits. Being “inside” the network grants nothing by itself.
mTLS · least privilege · microsegmentation
Extended detection & response
Endpoint, network, and cloud signals are correlated in one place, so a real attack stands out from the daily noise.
XDR · EDR · behavioural analytics
SIEM + SOAR automation
Centralised, tamper-evident logging with automated playbooks that contain threats in seconds, not hours.
log pipeline · auto-triage · runbooks
Passkeys & phishing-resistant MFA
Passwordless FIDO2 / WebAuthn and hardware keys — credentials that can’t be phished, replayed, or reused.
FIDO2 · WebAuthn · hardware tokens
Post-quantum cryptography
Crypto-agile, hybrid post-quantum key exchange — so traffic captured today can’t be decrypted by tomorrow’s computers.
ML-KEM (Kyber) · hybrid TLS · crypto-agility
Confidential computing
Sensitive data stays encrypted even while it is being processed, inside attested, hardware-isolated enclaves.
TEEs · encryption-in-use · attestation
Software supply-chain security
Every dependency scanned, every build signed, full provenance from source commit to running production.
SBOM · SLSA · Sigstore signing
Cloud-native runtime defense
Kernel-level (eBPF) runtime detection and cloud posture management catch drift and live threats inside containers.
eBPF · CNAPP · IaC scanning
Privileged access management
Just-in-time, time-boxed access to production — no standing admin rights, and every session is recorded.
JIT access · session recording · secrets vault
encryption
Encrypted in every state.
In transit
TLS 1.3 and mutual TLS between services, with perfect forward secrecy on every connection.
TLS 1.3 · mTLS · PFS
At rest
AES-256 on storage and backups, with keys held in a managed KMS / HSM and rotated on a schedule.
AES-256 · KMS / HSM · key rotation
In use
Confidential computing keeps data encrypted while it is being processed, inside attested hardware enclaves.
TEEs · enclaves · attestation
Quantum-ready. We deploy crypto-agile, hybrid post-quantum key exchange (ML-KEM) so encrypted traffic captured today cannot be quietly decrypted by tomorrow's hardware.
platform & data
How the Nintech platform is built.
The portal and fleet are held to the same bar as client work — and your data's residency, retention, and legal basis are explicit.
Identity & access
Role-based access throughout the portal; every admin action is permission-checked server-side on every request.
Session security
Session tokens are stored hashed (SHA-256), httpOnly, and expire automatically. Authentication is rate-limited.
Least-privilege ops
Fulfilment engineers get access scoped to the ticket at hand. Production credentials are never shared accounts.
Secure SDLC
Changes ship behind automated tests and dependency, secret, and static-analysis scanning before they reach production.
Residency
Choose London, Frankfurt, or New York per server. UK/EU-only residency is available for regulated workloads.
Retention
Server data is retained until you cancel; we schedule shutdown with you and provide a final export before decommissioning.
UK GDPR
We act as processor for data on client infrastructure and align handling with UK GDPR. A DPA is available on request.
when something breaks
Incident response, with times attached.
01
< 5 min
Detect
24/7 monitoring alarms on uptime, latency, backup health, and anomalous behaviour.
02
within SLA
Triage
A named engineer owns the incident, assesses blast radius, and opens your ticket with findings.
03
target < 4 hrs
Resolve
Fix, verify, and a written post-incident review in the same ticket thread.
| Tier | Uptime target | First response | Escalation |
|---|---|---|---|
| VPS, WordPress, Email & VPN | 99.9% | Next business day | Ticket escalation |
| Databases, Storage & Kubernetes | 99.9% | Next business day | Ticket escalation |
| GPU compute | 99.95% | 4 business hours | Senior engineer |
| Dedicated & colocation | As agreed | As agreed | Named engineer |
frameworks we map to
Described in the language auditors already use.
Recognised standards with honest status on each — no badge-collecting.
Cyber Essentials Plus
UK government-backed baseline — certification in progress.
UK GDPR
Aligned data handling; a Data Processing Agreement is available on request.
ISO 27001
Information-security management system roadmap underway.
NIST CSF 2.0
Controls mapped across Govern, Identify, Protect, Detect, Respond, Recover.
CIS Controls v8
Prioritised safeguards implemented across the platform and fleet.
OWASP ASVS
Application Security Verification Standard applied to every build.
Responsible AI
Client AI systems ship behind evaluation gates, with human review points on consequential actions. We never train models on one client's data for another's benefit, and we document model behaviour and known limitations as part of every handover.
Vulnerability disclosure
Found something? Email security@nintech.io. We acknowledge within one business day, keep you informed through remediation, and credit researchers who report responsibly.
engagement faqs
How does an engagement start?
Send a brief through the contact form or your portal. A senior engineer reads it the same day, we reply within one business day, and if it fits we run a scoping call and return a written proposal with milestones and price.
Who actually does the work?
Senior engineers only — the people you meet in scoping are the people who write the code. We don't resell your project to subcontractors or staff it with juniors.
Do you offer penetration testing and security assessments?
Yes — web, API, network, and cloud penetration tests, red-team engagements, and security audits, run by hand rather than a scanner alone. Every assessment includes a ranked findings report with proof-of-concept exploits, remediation guidance, and a free retest once you have fixed the issues. We work under NDA and to rules of engagement you approve.
How much does an engagement cost?
It depends on scope. Most one-off engagements land between £2k and £42k, and the estimator on this page gives a ballpark in seconds — pick a service, effort, and complexity. The exact figure comes from a scoping call and a written proposal against agreed acceptance criteria. Ongoing support is a monthly retainer sized to how much of the team you need. No hourly surprises.
How quickly can you start, and how long does it take?
Scoping usually happens within a week of your first message. Security assessments run one to three weeks; build engagements ship in slices with weekly demos, so you see working software from the first fortnight rather than only at the end.
Who owns the code and models?
You do. All code, fine-tuned weights, eval sets, and documentation are delivered to your repositories under your ownership. We retain nothing beyond what the contract requires for support.
Do you work on existing codebases?
Yes — most engineering engagements start inside a legacy system. We begin with a read-only audit, agree a risk map, and ship changes in slices gated by tests rather than proposing a rewrite.
Is my work kept confidential?
Yes. We sign NDAs as standard, keep client work strictly siloed, and never train models on one client's data for another's benefit. Findings and credentials from security work are handled on a need-to-know basis and destroyed on completion.
What if it isn't working out?
Fixed-scope work has acceptance criteria agreed up front; retained engagements are month to month with no lock-in. If a project is not clearing the bar we agreed, we say so early — a failing project stopped in month two is cheaper for everyone than a zombie that limps to month twelve.
A senior engineer reads every enquiry the same day — with a view on scope, not a sales pitch.