Cloud & DevOps in the US

About Cloud & DevOps

We run our own production infrastructure, including an EV charging platform with chargers live across multiple cities and a managed cloud hosting product, so cloud and DevOps is not theory for us. We help teams get off fragile manual deployments and onto infrastructure that is automated, observable, and cheap to run. That covers first-time cloud setup, migrating an existing app to AWS, Azure, or GCP, containerizing with Docker, and wiring up CI/CD so shipping is a push, not an ordeal.

What the engagement includes

• Cloud setup on AWS, Azure, and GCP
• Cloud migration from on-premise or other providers
• Docker containerization
• Kubernetes cluster setup and management
• CI/CD pipeline setup (GitHub Actions, GitLab CI)
• Infrastructure as code (Terraform)
• Serverless architecture (Lambda, Cloud Functions)
• Monitoring, logging, and alerting

What ITAR access rules, CMMC and New York's Part 500 ask of US cloud operations

If the workloads hold defense technical data, the first DevOps question in the US is who can read it, because under the ITAR an export can happen without anything leaving a server. Section 120.56 of the regulations says technical data is released when access information, such as a password, a key or a credential, is used to let a foreign person access, view or possess it unencrypted, and giving that access information to a foreign person needs the same authorization as handing over the data itself. An engineer in India with administrator rights on a bucket, a database or a backup holding such data is that foreign person, wherever the server sits. Under section 120.54(a)(5), sending, taking or storing unclassified technical data is not an export if it is secured with end-to-end encryption, using modules compliant with FIPS 140-2 or its successors or other means of at least AES-128 strength, and is not intentionally sent to or stored in a country proscribed in section 126.1, with data merely crossing the internet not treated as stored where it passes. End-to-end means the data stays encrypted between the originator's security boundary and the intended recipient's, so encryption whose keys the cloud provider holds, or that a pipeline decrypts in order to process, does not meet it. So when we run infrastructure for a US company with export-controlled data, the keys sit in the customer's key management service under policies only US persons in the customer's organization can satisfy, our access is to the control plane and to ciphertext, build and deploy pipelines never need plaintext, logs are scrubbed of technical data before they reach shared tooling, and a break-glass route exists that a US person approves and that is logged. The State Department proposed on 1 October 2026 to trim the Munitions List and add a licensing exemption, but until a final rule is published the current text governs. Whether your data is ITAR technical data is for your empowered official and counsel.

For a defense contractor the hosting arrangement has been a contract condition since 10 November 2025, when the DFARS rule implementing the Cybersecurity Maturity Model Certification program took effect and phase one began. Phase two starts one calendar year later, on 10 November 2026, and is when the Department of Defense intends to require a Level 2 certification from a third-party assessment organization as a condition of award on applicable contracts, with Level 2 built on the security requirements of NIST SP 800-171. The part that reaches an operations provider is the definition of an External Service Provider in 32 CFR 170.4: external people, technology or facilities that provide and manage IT or cybersecurity services for the contractor, counted as an ESP when controlled unclassified information or security protection data, such as log data or configuration data, is processed, stored or transmitted on its assets. A team that runs the contractor's monitoring pipeline, holds its Terraform state or ships its logs to an account it controls is therefore inside the assessment scope even if it never opens a CUI document, and the contractor's system security plan has to describe the service along with a customer responsibility matrix saying which party performs each requirement. A cloud service provider holding CUI must meet security requirements equivalent to the FedRAMP Moderate baseline under DFARS 252.204-7012, which also requires cyber incidents to be reported within 72 hours of discovery and the relevant images and packet capture data to be preserved for at least 90 days after the report. So we write the responsibility matrix with the contractor before the first deployment, keep state files and logs inside the contractor's own tenancy rather than ours, which keeps our assets out of scope wherever that is possible, and set log retention and snapshot policies so the preservation duty is met by default rather than remembered during an incident. Whether your contracts carry these clauses, and at which level, is for your contracting officer and assessor.

New York's cybersecurity regulation for banks, insurers and other firms licensed by the Department of Financial Services, 23 NYCRR Part 500, finished phasing in its 2023 amendment on 1 November 2025, and the last items to arrive were infrastructure work. Since that date multi-factor authentication has applied to any individual accessing any of a covered entity's information systems, not only to remote access, unless the entity qualifies for a limited exemption. The same date brought a written asset inventory that tracks, for each asset, its owner, location, classification, support expiration date and recovery time objective. Earlier phases already required privileged accounts to be limited, used only when needed and reviewed at least annually, backups sufficient to restore material operations and protected from unauthorized alteration or destruction, and an annual test of restoring critical data from them. The incident clock is short: notice no later than 72 hours after determining that a cybersecurity incident has occurred at the covered entity, its affiliates or a third-party service provider, and notice within 24 hours of any extortion payment, with a written explanation of the reasons within 30 days. Third-party service provider is the phrase that matters to an outside operations team, because an incident on our side starts your clock. For a DFS-regulated client that shapes the deployment. Human access to cloud consoles, clusters and databases goes through the client's identity provider with MFA, automation runs on non-interactive service identities, the asset inventory is generated from infrastructure code and cloud APIs with support end dates taken from the runtime and image versions actually deployed, backups go to storage with object lock so a compromised administrator cannot delete them, a full restore is rehearsed on a fixed date every year, and our contract commits us to report an incident to you quickly enough that your 72 hours are still usable. Whether your licence makes you a covered entity, and which exemptions apply, is for your own counsel.

How we work with US clients

A US engagement gets agreed twice. Once with the person who wants the thing built, and then again with legal, security, procurement and finance, who arrive separately and rarely in the same week. That second round is where a supplier outside the country loses the calendar: a master services agreement to redline, a security questionnaire, a certificate of insurance, and a vendor portal that assumes everyone it onboards can sign a W-9. Send all of it while the scope is still being written rather than in the week you wanted to start, and where the honest answer to a row is that we do not hold something, we write that in rather than leaving it blank.

You are also buying from a company you cannot drop in on, so the evidence has to do the work an office would otherwise do. What we send is live production URLs rather than a deck, a written scope with one fixed number against it, and the names of the people who will do the work rather than a bench that changes after signature. What we will also tell you is the shape of what you are hiring: a small team in Noida that has been building since 2021, not a firm that can put four more people on your project next Monday. If that is what your timeline needs, we say so before the contract rather than after it.

Indicative pricing in USD

Converted from our published Indian rates and rounded. Exchange rates move, so the figure on your quote is calculated on the day it is issued.

Questions US clients ask

Cloud & DevOps: common questions

Other markets we work in