New field note:Rebuilding TopQbank: why we chose greenfield TypeScript over modernizingRead it →

Your cloud deserves an architect, not another vendor.

CloudGuard designs, secures and builds production platforms on AWS, Azure, GCP and OCI. Senior architects, accountable from the first decision to the platform running in production.

Book a free consultationSee our work

Most cloud platforms get built twice. We build yours once.

Three architects reviewing a cloud architecture diagram together

Built fast, then rebuilt

Platforms rushed to launch without a target architecture end up rewritten within two years. We write the decisions down first.

Security added last

Controls bolted on after go-live cost more and protect less. We design identity, keys and logging in from day one.

Nobody owns the whole thing

Architects hand off to developers, who hand off to operations. With us, one team is accountable from diagram to production.

What we do

Secure cloud platforms, end to end.

Secure

Our specialty: security designed into the platform, watched after launch and ready for the audit.

Security, governance & Zero Trust

Identity-first security, least-privilege access and compliance controls built into the platform, mapped to the frameworks your auditors use.

Asset Optimizer app servers have no public IP: traffic enters only through Front Door, WAF and Private Link.

  • Security posture assessment with a ranked fix list
  • Zero Trust identity design with Entra ID federation
  • NIST CSF / 800-53, ISO 27001 and SOC 2 control mapping
  • Audit-ready logging, evidence and guardrails
Entra IDIAMKMSWAFGuardDutySentinel

Cloud security operations

Ongoing defence after go-live: detection tuned to your cloud, regular threat and vulnerability reviews, and a tested plan for when something goes wrong.

  • SIEM and detection rules tuned to your workloads
  • Monthly threat and vulnerability review with a fix list
  • Incident response runbooks and SLA-backed response
  • Optional managed detection partner for 24/7 cover, overseen by us
Microsoft SentinelDefender for CloudGuardDutySecurity HubOCI Cloud Guard

Compliance readiness

A fixed-scope path to the audit: gap assessment, controls built into the platform, and the evidence your auditor will ask for.

  • Gap assessment against SOC 2, ISO 27001, PIPEDA or PHIPA
  • Policies and controls mapped to the platform
  • Automated evidence collection and audit logging
  • Auditor walkthrough support
AWS Audit ManagerAzure PolicyMicrosoft PurviewAWS Config
Ways to work with us

Buy an outcome, not a block of hours.

Launch

Build it right

From idea to a production platform on AWS, with the foundations done properly the first time.

  • Target architecture and decision records
  • Terraform landing zone
  • CI/CD with keyless deploys
  • Auth, database and CMS set up
  • Monitoring and cost alarms
Scope a launch
Modernize

Move it safely

Move a legacy app to the cloud, or rebuild it greenfield, without a big-bang cutover.

  • Assessment and migration plan
  • Re-platform or greenfield rebuild
  • Parallel run on a new subdomain
  • Data migration and cutover
  • Security review before go-live
Plan a migration
Fortify & operate

Keep it safe

Harden what you already run, then hand us the pager.

  • Security posture assessment
  • Zero Trust and IAM cleanup
  • FinOps review and savings plan
  • 24/7 monitoring and on-call
  • Monthly health report
Get an assessment
Client stories

Platforms we architected, built and still run.

The TopQbank website home page
TopQbank
Medical education · SaaS

A greenfield rebuild of an exam-prep platform for PLAB, USMLE, AMC, MCCQE, MRCP and more.

  • Legacy Angular and .NET replaced with one TypeScript codebase
  • Admins manage the whole exam catalogue in a CMS, with no deploys
  • AI question and image generation with monthly spend caps
Next.jsNestJSAuroraSanityCognitoTerraform
Read the story →
The TopMedCast website home page
TopMedCast
Medical podcast · AWS

A podcast website a doctor publishes to himself, with no developer in the loop.

  • Episodes, guests and show notes managed in a headless CMS
  • Static site on S3 and CloudFront, deployed by CI
  • RSS feed generated at build time for podcast apps
Next.jsSanityS3CloudFrontGitHub Actions
Read the story →
UsersFront Door+ WAFPrivate LinkPRODUCTION SUBSCRIPTION · APP SPOKEIIS VMno public IPIIS VMno public IPAzure SQL elastic poolprivate endpointHUB NETWORKFirewallswitchableBastionswitchableNON-PROD SUBSCRIPTIONTest spokesame modules, smaller sizespeering
Asset Optimizer
IDS.Consulting · SaaS on Azure

A secure Azure landing zone for IDS.Consulting's Asset Optimizer SaaS, built in code beside a hand-built estate and ready for a calm migration.

  • Hub-and-spoke network across separate prod and non-prod subscriptions, with policy guardrails
  • App servers with no public IP, reached only through Front Door, WAF and Private Link
  • Cost switches kept firewall, Bastion and SQL off until needed, saving over $1,000 a month during the build
AzureTerraformFront DoorAzure FirewallAzure SQLEntra ID
Read the story →

What sets us apart

Senior architects on every engagement

The people who design your platform are the people who build it. No juniors learning on your production estate.

Security designed in from the first diagram

Zero Trust identity, least privilege, encryption and keyless deploys are part of the architecture, not a phase at the end.

Certified across four clouds

AWS, Azure, Google Cloud and OCI, backed by TOGAF and CCSP. We recommend the platform that fits, not the one we resell.

You own everything we build

Terraform, decision records and runbooks are handed over in your repositories, so your team can run it without us.

What our clients say

  • CloudGuard didn't just patch our old platform, they told us honestly that it needed rebuilding, then delivered it. Our team now runs the whole exam catalogue themselves, and every change ships in minutes instead of weeks.

    Dr. ElgendyFounder, TopQbank

  • I publish every episode myself, with no developer in the loop. The site is fast, it costs almost nothing to run, and it simply works.

    Dr. ElgendyHost, TopMedCast

How we work

Decisions written down. Infrastructure in code. Nothing hand-built twice.

01

Assess

We map what you run, what it costs and where the risk is, and turn it into a ranked list of recommendations.

02

Architect

Target design and decision records, agreed with your team before anything is built.

03

Build

Infrastructure and product in code, shipped behind a new subdomain and verified before cutover.

04

Operate

Monitoring, cost reviews and on-call, so the platform keeps improving after launch.

Insights

Notes from the build.

All articles →
A doctor studying for a licensing exam at a laptop in the eveningCase studyOctober 18, 2026

Rebuilding TopQbank: why we chose greenfield TypeScript over modernizing

The architecture decision behind replacing a legacy Angular and .NET exam-prep platform, and what the rebuild changed for the business.

A paper model of a city laid out as a hub with spokes, with orange switches on some connections
ArchitectureOctober 16, 2026

An Azure landing zone that costs almost nothing until you need it

How we built a hub-and-spoke Azure landing zone for IDS.Consulting's Asset Optimizer SaaS in Terraform, with cost switches that kept over $1,000 a month switched off during the build.

A brass key dissolving into particles that drift toward a server rack
DevSecOpsOctober 14, 2026

Keyless deploys: GitHub Actions to AWS with OIDC and Terraform

Why every CloudGuard platform deploys without a single stored cloud key, and the exact setup we use.

15+
years of enterprise cloud architecture
4
clouds: AWS, Azure, Google Cloud and OCI
10
professional certifications, including TOGAF and CCSP
About CloudGuard

A Canadian cloud architecture and security firm.

CloudGuard Technologies designs, secures and governs cloud platforms for government and enterprise. Our architects bring more than 15 years of experience across AWS, Azure and OCI, and we stay accountable from the first architecture decision to the platform running in production.

Our work spans landing zones, Zero Trust identity, security and compliance (NIST, ISO 27001, SOC 2), DevSecOps and FinOps. Every engagement ends with infrastructure in code and decisions written down, so your team owns what we build.

Certifications
TOGAFCCSP – Certified Cloud Security ProfessionalOCI Certified ArchitectAWS DevOps Engineer – ProfessionalAWS Security – SpecialtyAWS Advanced Networking – SpecialtyAWS Big Data – SpecialtyAWS SysOps Administrator – AssociateAWS Developer – AssociateAWS Solutions Architect – Associate

Industries we serve: Government & public sector · Transportation & rail · Financial services · Telecommunications · Healthcare & medical education

CloudGuard on LinkedIn →Read our insights →

Have a platform to build, migrate or secure?

Book a free 30-minute call. You'll leave with a clear next step, whether or not we work together.

Book a free consultationmohamed.mohey@cloudguardtech.com