Cloud & DevOps in Singapore

About Cloud & DevOps

We run our own production infrastructure, including an EV charging platform with chargers live across multiple cities and a managed cloud hosting product, so cloud and DevOps is not theory for us. We help teams get off fragile manual deployments and onto infrastructure that is automated, observable, and cheap to run. That covers first-time cloud setup, migrating an existing app to AWS, Azure, or GCP, containerizing with Docker, and wiring up CI/CD so shipping is a push, not an ordeal.

What the engagement includes

• Cloud setup on AWS, Azure, and GCP
• Cloud migration from on-premise or other providers
• Docker containerization
• Kubernetes cluster setup and management
• CI/CD pipeline setup (GitHub Actions, GitLab CI)
• Infrastructure as code (Terraform)
• Serverless architecture (Lambda, Cloud Functions)
• Monitoring, logging, and alerting

The amended Cybersecurity Act, Government on Commercial Cloud and CSA's cloud marks in Singapore DevOps

The amendments to Singapore's Cybersecurity Act that came into force on 31 October 2025 reach past the owners of Critical Information Infrastructure to the people who run their pipelines. CII covers computer systems directly involved in essential services in energy, water, banking and finance, healthcare, transport, infocomm, media, security and emergency services, and government. The amended Act keeps the owner responsible when that infrastructure moves to the cloud, defining the owner of a virtual computer system as whoever has exclusive control of it, and section 14 now requires the owner to report prescribed incidents not only on the CII itself but on other systems under its control and on any system under a supplier's control that is interconnected with or communicates with the CII. A DevOps provider is exactly that supplier. Our CI runners, deployment credentials, monitoring agents and remote administration paths into a CII environment are supplier systems communicating with it, so an incident on our side can become something your organisation has to report. The contract sets how fast we tell you about an incident on our systems and what evidence comes with it, and the build makes that answerable: deploy credentials are short-lived and scoped per environment, pipeline and access logs are retained where you can read them, and the paths from our tooling into the CII environment are few, named and monitored, so whether an event touched your system is settled from records rather than recollection. The same amending Act, passed in May 2024, also created regimes for entities of special cybersecurity interest and for major foundational digital infrastructure providers such as cloud service providers and data centres, but the current version of the Act on Singapore Statutes Online at 2 October 2026 does not yet include those Parts, so a design should not assume your cloud provider is already bound by codes of practice under them. Whether your systems are designated, and what you must report and when, is for your own counsel and CSA.

When the client is a ministry or statutory board, the cloud is usually Government on Commercial Cloud, and its rules decide how an outside DevOps team works. GCC is GovTech's wrapper over AWS, Microsoft Azure and Google Cloud, with GCC 2.0 hosting systems classified as Confidential (Cloud-Eligible) and GCC+ hosting those classified as Confidential. Onboarding runs through a TechPass account, accounts are created by automated vending rather than tickets, and every resource is checked against policy as code by default. The access rule is the one vendors trip over. Engineers reach GCC from a Government Standard Image Build device or from an internet device enrolled in SEED, which checks the endpoint against a CIS hardening benchmark, patch status and malware and revokes access automatically when the device falls out of compliance, using Intune, CrowdStrike Falcon and Tanium behind Cloudflare's zero trust client. So which of our engineers will hold accounts, on which enrolled devices, is agreed with the agency before the first sprint, not discovered on day one. The pipeline is shaped the same way. GovTech's SHIP-HATS provides GitLab with managed shared runners, pipeline templates and a compliance framework aligned with the government's ICT and smart systems management policies and IM8 DevSecOps guidelines, with SonarQube for code quality, Nexus IQ for dependencies, FOD for static and dynamic testing and an optional SLSA add-on for build integrity. Its subscription admins must be public officers, never vendors, and most development actions such as git push cannot be done from a non-SE GSIB device. A vendor who arrives with a GitHub Actions workflow and its own runners is therefore rebuilding it as a SHIP-HATS pipeline, and the infrastructure code has to pass GCC's policy checks rather than the vendor's defaults. Which classification your system carries, and therefore which GCC tier it lands in, is the agency's decision.

For private sector clients the yardstick is increasingly CSA's own marks rather than a foreign certification. On 15 April 2025 CSA expanded Cyber Essentials, aimed at smaller organisations, and Cyber Trust, aimed at larger or more digitalised ones, to cover cloud security alongside AI and operational technology, and said it is assessing whether organisations given access to sensitive data should hold these marks before they can be licensed or bid for government contracts. In the expanded Cyber Essentials, an organisation is expected to use the cloud shared responsibility model to set the scope of work with its provider and to secure user-level settings; Cyber Trust walks it through cloud risk scenarios, one of them an attacker exploiting an insecure API in the organisation's cloud service to reach its data or disrupt delivery. Two companion guides launched by CSA and the Cloud Security Alliance on 17 October 2023, developed with AWS, Google Cloud and Microsoft, explain the split: the Cyber Essentials guide sets out what the customer and the provider each secure, and the Cyber Trust guide maps each Cyber Trust domain to the Cloud Security Alliance's framework. That gives a DevOps engagement a deliverable your assessor will actually ask for. Alongside the infrastructure code we hand over a shared responsibility matrix for every managed service in use, saying which side configures, patches, logs and backs up each one; an inventory of the cloud services and accounts generated from the code rather than kept by hand, since the guides ask organisations to track their cloud service inventory; and evidence for the API scenario in the form of gateway authentication, rate limits and logging that can be shown working. The marks are yours to obtain through an appointed certification body, and the evidence is cheaper produced by the pipeline than assembled before an assessment. Which mark fits your organisation, and when, is a decision for you and your certification body.

How we work with Singapore clients

Singapore is the one market we serve where the working day is simply shared. We are two and a half hours behind you and neither country moves its clocks, so our morning starts partway through yours and the whole of your afternoon is live time for both sides. That changes the shape of an engagement more than anything technical does: a call is booked for the same afternoon rather than the same week, a question raised before your lunch is answered after it, and the written-first method we run for North American clients is a courtesy here rather than a necessity. We keep the written record anyway, with a default chosen on every open decision, because it is the thing an auditor or a new hire can read later and a call is not.

Invoicing is worth stating plainly because the GST position confuses buyers on both sides. We are outside Singapore, so no GST appears on our invoice. Whether you account for it yourself is the reverse charge question, and IRAS's own guidance is that a GST-registered business making only taxable supplies is not affected, while a partially exempt one accounts for it in its own return. We quote in Singapore dollars, the figure holds for the project whatever the rupee does, and payment by bank transfer or Wise avoids the card fees a five-figure invoice does not need. The contract can sit under Singapore law with Singapore courts, and unusually among our overseas markets that clause has teeth: Singapore is a reciprocating territory under section 44A of India's Civil Procedure Code, so a judgment of the Singapore High Court can be executed in India directly rather than re-litigated.

Indicative pricing in SGD

Converted from our published Indian rates and rounded. Exchange rates move, so the figure on your quote is calculated on the day it is issued.

Questions Singapore clients ask

Cloud & DevOps: common questions

Other markets we work in