Graphite & Moss

Victoria, BC · Victoria

Software, cloud & cybersecurity · Victoria, BC

We’re software and cloud engineers.

We build your apps, set up the cloud they run on, and keep it all secure.

  • App developmentWeb apps, internal tools and AI features, built for your business.
  • Cloud infrastructureAWS, Google Cloud or Azure, set up properly and kept running.
  • CybersecurityThe technical side: hardening, monitoring, and a plan for when something goes wrong.
Get a scoped estimate

Tell us what you need built, moved or secured. You get scope, cost and timeline in writing within two business days.

Services / 03

The whole stack, one studio.

Three things, one team: we build your apps, run the cloud they live on, and keep it all secure.

  1. We build the software your business runs on — web apps, internal tools, and the connections between the programs you already pay for. When AI can do a real job, like reading forms or answering questions from your own documents, we build that in too, and we test it before your team relies on it.

    More on app development

    • Web applications
    • Internal tools
    • Integrations & APIs
    • AI features & assistants
    • Document & data extraction
    • Testing & guardrails
  2. We set up the cloud your apps run on — AWS, Google Cloud or Azure, or our own managed hosting when that's all the job needs — and keep it running. Every account and server is set up so it can be checked and rebuilt, backups are tested by actually restoring them, alerts reach a person, and the monthly bill makes sense.

    More on cloud infrastructure

    • AWS
    • Google Cloud
    • Azure
    • Setup written as code
    • Automated testing & deploys
    • Containers & networking
    • Backups & recovery
    • Monitoring & cost
    • Managed hosting
  3. The technical, hands-on side of security. We lock down your servers and cloud accounts, watch for trouble so a break-in is caught in hours rather than months, check your code for known weak spots, and write a plan for the day something goes wrong — including the new risks AI brings, like a chatbot that can be tricked into leaking data.

    More on cybersecurity

    • Cloud security (AWS · GCP · Azure)
    • Identity & access
    • Monitoring & detection
    • Code & dependency scanning
    • Hardening & patching
    • Incident response
    • AI security

We also design, build and host websites on Minservers, our managed platform — mostly for businesses we already work with.Websites

Built here. Run here. Engineered to hold up.

Every engagement can continue onto managed infrastructure we operate ourselves.

Security leadership, compliance, risk and AI strategy sit with our sister company, Signal & Soil.

Where it starts

Sound familiar?

Offers / 04

Four ways to start.

Each one has a fixed shape, a written result and a length you can plan around. They follow the same order as what we do: build, run, secure.

  1. Build Sprint

    Teams with an app, tool or AI feature to build — and no one free to build it.

    Build Sprint in detail

    Length
    2–8 weeks
    Price
    Quoted in writing
  2. Cloud Foundation

    Teams whose app runs on a cloud account that was set up in a hurry — or by someone who has left.

    Cloud Foundation in detail

    Length
    4–8 weeks
    Price
    Quoted in writing
  3. Exposure Review

    Companies about to face a big customer's security questions, an audit or an investor.

    Exposure Review in detail

    Length
    5 days
    Price
    Quoted in writing
  4. Incident Readiness

    Anyone whose plan for a break-in or outage is “call someone”.

    Incident Readiness in detail

    Length
    3 weeks
    Price
    Quoted in writing

How it works

Scope first, in writing.

  1. A 30-minute call, or just the form. Scope and cost in writing within two business days.

  2. Start with one fixed-shape offer. What it hands over is yours to use with us, your team or anyone else.

  3. Keep going month to month, or walk away. You keep the code, the accounts and the instructions for running them.

Selected work / 04

What it looks like in practice.

Client work, our own ventures, and how we run our own platform — each one labelled.

All case studies

Have something to build, run or secure?

Get a scoped estimate

Track record

Proven at a much larger scale.

Most of our team comes from Microsoft, and has since run security, cloud infrastructure and AI-assisted operations for platforms with millions of users. This is experience our people bring from before and alongside the studio, not a list of studio clients. The same discipline goes into a five-person business’s cloud.

More about the studio


Contact

Start something.

Tell us what you need built, moved or secured — an app, a cloud setup, a security check. You get scope, cost and timeline in writing within two business days.

Get a scoped estimate