Skip to content
Discuss a project

Software · 03 · Cloud, APIs & integrations

Cloud, APIs & integrations that keep data moving.

We set up the hosting, databases, APIs and access control that let devices, business systems and apps exchange data securely, through interfaces that are documented and observable.

Discuss your requirements View related projects
Integration architecture: four clients connected through an API gateway to a cloud deploymentA field gateway, an ERP or accounting system, a mobile app and a web dashboard sit outside a dashed deployment boundary. Each connects through a public edge zone where TLS, authentication and rate limits are applied. Inside, an application zone holds a message queue, a worker, integration jobs and a REST API service; a private data zone holds a PostgreSQL database, object storage and backups. An amber trace follows one pressure reading from the field gateway through TLS and authentication into the queue, through the worker into the readings table, and back out through the API service to the web dashboard.CLIENTS · OUTSIDEDevice reading pathOther API trafficPort / interfaceDEPLOYMENT BOUNDARY · CLOUD ACCOUNT · PRODUCTIONSTAGING: SAME LAYOUT, SEPARATE DATAZONE A · PUBLIC EDGEZONE B · APPLICATIONZONE C · DATA · PRIVATENo public address. Reachable onlyfrom services in zone B.API GATEWAYSingle public entry, HTTPS onlyTLSAUTHRATEdevice key · 60 req/minOAuth client · signed hookuser token · technicianuser session · supervisorFIELD GATEWAYERP / ACCOUNTINGMOBILE APPWEB DASHBOARDModbus RTU inHTTPS outPOST /v1/readingsInvoicessyncedCost centressyncedPOST /v1/webhooks/erpWork ordersoffline, syncs laterGET /v1/work-ordersSupervisorstrends, alarmsGET /v1/assets/{id}/readingsPAYLOAD · POST /v1/readings{ "asset": "P-101", "tag": "PT-101","value": 4.2, "unit": "bar","ts": "2026-10-15T09:42:10Z","quality": "good" }QUEUE · readings.ingestWORKERINTEGRATION JOBSAPI SERVICE · REST /v1OPENAPI 3validate · scale · storeERP sync: webhook in, nightly reconcile, retries/v1/readings/v1/assets/v1/work-orders/v1/webhooks/erpwrite, querylist, detailcreate, assign, closeinbound, signedtyped errors: 400 · 401 · 403 · 429Versioned, paginated, every request loggedGET /v1/health for monitoringDATABASE · POSTGRESQLassetsreadingswork_orderserp_sync_logusers, rolestime-seriesMigrations versioned with the codeEncrypted at rest and in transitOBJECT STORAGEreports/ exports/ attachments/Private bucket, time-limited linksLifecycle rules for old exportsBACKUPSScheduled snapshots, database + filesRestore steps written and rehearsedOBSERVABILITYStructured logs, metrics and alerts from every zone, routed to a named owner12345 Sequence of one device reading: field gateway, API gateway, queue, worker and database, API service, web dashboardCLOUD DEPLOYMENTFIELD GATEWAYAPI GATEWAYQUEUE · readings.ingestWORKER → DATABASEAPI SERVICEWEB DASHBOARDTLS → device key → rate limitaccepted now, processed in ordervalidated, written to readings(time-series table)same gateway, user sessiontrend shown with alarm limitsPOST /v1/readingsGET /v1/assets/{id}/readings12345ERP, mobile and other clients use the same gateway.
{ "asset": "P-101",
  "tag": "PT-101",
  "value": 4.2, "unit": "bar",
  "ts": "2026-10-15T09:42:10Z" }
  1. 1 · TLSEncrypted from the gateway to the edge.
  2. 2 · AUTHDevice key checked, rate limit applied.
  3. 3 · QUEUEReading accepted now, processed in order.
  4. 4 · STOREValidated and written to the readings table.
  5. 5 · SERVEThe dashboard reads it back through the same gateway.
Illustrative architecture · services, names and limits are chosen per project

Spec sheet · What we set up

Six parts of the connective layer, each with a written deliverable.

Not every project needs all six. The exact package is agreed from your context, risk, timeline and the responsibilities your team keeps.

Scope your integration
  1. 01

    Hosting & environments

    Cloud accounts, networks and separate development, staging and production environments, sized to the workload you actually run.

    You receive

    • Environment map
    • Access and ownership list
    • Running-cost notes
  2. 02

    Databases

    Schema design, migrations and storage for business records, time-series readings and files, with backups from the first release.

    You receive

    • Schema diagram
    • Migration scripts
    • Backup and restore schedule
  3. 03

    APIs

    Versioned endpoints with typed requests and predictable errors, documented while they are built rather than afterwards.

    You receive

    • OpenAPI specification
    • Example requests
    • Change log per version
  4. 04

    Authentication & access control

    Sign-in for people, keys for devices and services, and role-based permissions that match how your organisation works.

    You receive

    • Role and permission matrix
    • Key issue and rotation procedure
  5. 05

    Third-party & legacy integrations

    Connections to ERP, accounting, messaging or older databases, with retries, reconciliation and a record of what synced.

    You receive

    • Integration map
    • Field mapping tables
    • Error-handling notes
  6. 06

    Deployment

    Repeatable builds and releases from a pipeline, with a tested way back if a release misbehaves.

    You receive

    • Deployment runbook
    • Pipeline configuration
    • Rollback steps

Security & reliability basics

Practices built in from the first release.

These are working practices we apply by default, not certifications. If your project needs formal compliance against a named standard, we scope that separately and say so in writing.

Security

HTTPS everywhere
Every interface, internal and public, is served over TLS. No plain-text endpoints, including for devices.
Server-side validation
Requests are checked on the server against the API specification, whatever the client already checked.
Restricted administration
Admin access is limited to named people, separated from everyday accounts, and logged.
Spam and abuse controls
Rate limits and abuse checks on public forms and endpoints.
Minimal personal data
We collect only what the system needs and agree how long it is kept.

Reliability

Clear error handling
Failures return a useful message to the client and a traceable entry in the logs.
Delivery monitoring
Queues, integrations and outbound messages are watched, so a stalled sync is noticed before a user reports it.
Backups with a restore plan
Scheduled backups of databases and files, and written steps for restoring them.
Deployment documentation
How the system is built, configured and released, written down for whoever maintains it next.
An agreed maintenance owner
Someone named, on your side or ours, is responsible for updates and alerts after go-live.

Start a conversation

Talk through your cloud, APIs & integrations requirements.

Tell us which systems need to exchange data and what happens when they do. We will come back with the parts we would set up and the questions to answer first.

A good fit for

  • Systems that need to exchange reliable data
  • Products moving toward scalable hosting
  • Teams consolidating disconnected services
Discuss your requirements

Inquiries are routed to the relevant practice lead.