Cloud & DevOps in the UK

About Cloud & DevOps

We run our own production infrastructure, including an EV charging platform with chargers live across multiple cities and a managed cloud hosting product, so cloud and DevOps is not theory for us. We help teams get off fragile manual deployments and onto infrastructure that is automated, observable, and cheap to run. That covers first-time cloud setup, migrating an existing app to AWS, Azure, or GCP, containerizing with Docker, and wiring up CI/CD so shipping is a push, not an ordeal.

What the engagement includes

• Cloud setup on AWS, Azure, and GCP
• Cloud migration from on-premise or other providers
• Docker containerization
• Kubernetes cluster setup and management
• CI/CD pipeline setup (GitHub Actions, GitLab CI)
• Infrastructure as code (Terraform)
• Serverless architecture (Lambda, Cloud Functions)
• Monitoring, logging, and alerting

FCA impact tolerances and the 2027 reporting rules, the CMA's cloud findings, and one London region

If the client is regulated by the FCA, a cloud and DevOps engagement is built to targets the firm has already set. Firms in scope of the operational resilience rules had until 31 March 2025 to show they could keep each important business service within its impact tolerance, the maximum disruption the firm has decided it can tolerate, and that figure, not a provider's availability promise, is what the recovery design answers to. If the tolerance for making a payment is 24 hours, the failover plan, the runbooks and the restore tests are written and timed against 24 hours, and a test that brings back the database but not the identity provider or the pipeline that deploys to it has not tested the service. From 18 March 2027 the FCA, the PRA and the Bank of England move to a single regime for incident and third party reporting under policy statement PS26/2. A firm reports an operational incident as soon as practicable, which the FCA's guidance expects to mean within 24 hours of deciding it meets a threshold, payment service providers keep their four hour window from first detection, and a final report follows within 30 working days of resolution. That puts a timestamped incident record into the platform: when the incident was detected, when it was judged to cross a threshold, which services and how many customers it touched, and when each was restored. In-scope firms, banks, building societies, payment and e-money institutions and enhanced scope SM&CR firms among them, will also keep a register of material third party arrangements and submit it each year, and the template asks for the country where the data is stored and the country the service is delivered from. A managed DevOps service run by engineers in India is answered as India in the second box even when every byte sits in London. Whether an arrangement is material, and whether an incident crosses a threshold, is for your compliance team.

The CMA has also put the economics of UK cloud on the record. Its market investigation, which reported on 31 July 2025, found the infrastructure market highly concentrated, with AWS and Microsoft each holding 30 to 40 per cent of supply in 2024, and fewer than 1 per cent of customers switching provider in a year. It named egress fees, the charges for moving data out, as a key barrier to switching and to using more than one cloud, and found that Microsoft's licensing of Windows Server, SQL Server and related products made them dearer or unavailable on AWS and Google Cloud, harming competition. Rather than impose remedies itself, it recommended that the CMA use its digital markets powers. On 31 March 2026 the CMA said Microsoft and Amazon had set out steps on egress fees and interoperability for UK customers, which it would keep under review, and in May it opened a strategic market status investigation into Microsoft's business software, with a decision on designation due by February 2027 that could let it act on the licensing finding. For a migration that argues for keeping two decisions open. A workload running on Windows Server or SQL Server is priced on each cloud under the licence terms that apply today, written down as an assumption, and priced again if the outcome next February changes them. Egress is modelled as a real line, both for the exit nobody plans to use and for any second provider an operational resilience review may ask for, using the UK terms current at the time rather than an old rate card. The design can lower the stakes as well: data kept in open formats, infrastructure written in Terraform rather than built by hand in a console, and each managed service chosen with its nearest equivalent on another cloud in mind. How any of this bears on your existing contracts is for your counsel.

Keeping a workload in the UK is narrower than it sounds once recovery comes into it. AWS has one UK region, London, with three availability zones, and Google Cloud also has one, europe-west2 in London, while Azure runs two, UK South and UK West, which it documents as a region pair. On AWS or Google a UK only clause therefore means resilience across zones inside a single London region and nothing beyond it, because a second region means leaving the country, usually for Ireland. Whether that matters depends on what the clause is protecting. For personal data, moving a replica to Ireland is not a restricted transfer, since UK law treats every EEA country as adequate, and the European Commission's renewed adequacy decisions for the UK, which run until 27 December 2031, keep personal data flowing back from the EEA, which suits a business serving EU customers from London. Contracts and public sector terms are a separate question, so the residency wording is read for whether it says UK, or UK and EEA, before the recovery region is picked. Where it says UK only and the platform is AWS or Google, the buyer is shown the choice plainly: accept a recovery design that survives the loss of a zone but not of the region, change the wording, or move the workload to Azure's pair. Some services sit outside any region altogether. On AWS, identity management and DNS are global services, so a residency review covers where the control plane runs and where configuration lives as well as where the database is. And because the zone is the unit of failure inside London, the recovery tests are run by taking a zone out, not by restarting a server. Whether your residency wording permits an EEA region is for your own counsel.

How we work with UK clients

UK engagements tend to start with procurement questions rather than technical ones. Who holds the data, which law governs the contract, whether you can produce a record of processing if the ICO asks. We answer those in the proposal instead of leaving them to a legal review three weeks in, because that review is where UK projects usually stall.

Invoicing is the other thing worth settling early. We are outside the UK, so services we supply generally fall under the reverse charge and your finance team accounts for the VAT rather than paying it to us. Our invoices say so explicitly. We quote in pounds, the figure does not move with the exchange rate mid-project, and payment by bank transfer avoids the card fees that make a five-figure invoice unnecessarily expensive.

Indicative pricing in GBP

Converted from our published Indian rates and rounded. Exchange rates move, so the figure on your quote is calculated on the day it is issued.

Questions UK clients ask

Cloud & DevOps: common questions

Other markets we work in