Technology
We choose technology after we understand the problem, so this page is not a menu. It lists what the firm's principal has built with, area by area, for readers who want to know whether he has worked with something like what they run.
Databases
We work with PostgreSQL, Oracle, and SQL Server, including moving data and schemas between them. A full database server is not always needed, and a small system is often better served by an embedded one.
-
Server databases
Schema design, query performance, synchronization between systems, and migration from one platform to another.
-
Embedded and in-browser storage
Databases that live inside the application, including offline web applications that sync when a connection returns.
Systems integration
Systems bought or built at different times rarely share a format. We connect them through the interfaces they already have: a documented API, an XML exchange format, a file export, or email.
-
APIs and exchange formats
Services with published contracts, and the older formats government and laboratory systems still use.
-
Email and notifications
Reading and sending mail on the major providers, and alerts by text message, push notification, and chat.
AI and language models
Language models are useful when they can reach an organization's own documents, data, and rules, and when a person can see and check what they did. Most of the engineering is in that connection, not in the model. Models change quickly, so we keep the choice of model replaceable, and some work runs on local models so that the data never leaves your own hardware.
-
Reading documents and correspondence
Pulling dates, obligations, names, and entities out of email, letters, and regulations, and turning them into schedules, work queues, and linked records.
-
Answering questions from your own data
Questions in plain English answered from an organization's documentation and databases, including generating the database query, run read-only and logged.
-
Models, hosted and local
Hosted models through standard APIs, routed by task and cost, and open models run on local hardware.
-
Testing what the model does
Evaluation suites that compare approaches on real cases, and recorded replays so behavior can be checked after every change.
Applications, reporting, and documents
Web applications, internal tools, command-line tools, and the documents and reports they produce.
-
Languages
Server, command-line, and browser code.
-
Web applications
Interfaces, APIs, installable offline apps, and desktop packaging, with automated testing that includes accessibility checks.
-
Reports and documents
Generated letters and reports, filled PDF forms, spreadsheets, and dashboards.
Hosting and legacy systems
We deploy on your servers or in the cloud, and we keep older systems running while they are still needed. That includes database and application-server versions well past their end of support, upgraded or replaced in stages.
-
Hosting
Linux servers, containers, and cloud hosting, with automated certificates and off-site backups.
-
Older applications
Keeping old applications in service, including under emulation when their platform no longer exists, and moving their data forward.
Security and cryptography
Cryptography is already part of everyday systems. The padlock in a browser means the website presented a certificate proving it controls its address, and the connection is encrypted. A signed file proves who sent it and that nobody changed it on the way.
Two kinds of cryptography do that work. Symmetric encryption, such as AES, uses one shared key and protects the data itself. Asymmetric cryptography, such as RSA and elliptic curves, uses a public key and a private key. It is what lets two parties who have never met agree on a key, and what makes digital signatures possible.
The quantum problem
A large enough quantum computer would break the asymmetric half: RSA and elliptic-curve signatures and key exchange. Symmetric encryption with long keys, such as AES-256, is not seriously affected. Nobody has built that computer yet. The urgent reason to act now is that encrypted traffic recorded today could be decrypted once one exists. Signatures are a slower problem: records that must be trusted for decades need signatures that stay unforgeable that long.
In 2024 NIST published replacement standards: ML-KEM (FIPS 203) for agreeing on keys and ML-DSA (FIPS 204) for signatures. For federal systems, National Security Memorandum 10 sets 2035 as the goal, and the 2024 draft of NIST IR 8547 proposes deprecating the weaker variants of RSA and elliptic curves, such as RSA-2048, after 2030 and disallowing both after 2035. National security systems follow NSA's CNSA 2.0, which has earlier dates and larger parameter sets.
For most organizations the work is an inventory of where signatures and key exchange are used, followed by a staged migration, the same shape as any other system migration. The first step is usually hybrid key exchange, classical and ML-KEM together, which current browsers and TLS libraries already support. Production systems rely on the established libraries listed below, and our code is tested against NIST's published vectors. That is neither a CAVP algorithm certificate nor FIPS 140-3 module validation. Where validation is required, the design uses a validated module.
-
Signatures
ML-DSA signing and verification in Go, TypeScript, and Python, with shared test vectors confirming identical output across all three. Classical signature verification for data submissions.
-
Key agreement and key management
Post-quantum key encapsulation, and key hierarchies where one recovery phrase regenerates every key a system uses. That phrase then has to be protected as carefully as all of the keys together.
-
Encryption and hashing
Encryption of files and records on servers, on the command line, and in the browser before the data leaves the user's machine. Password-based keys that are expensive to guess.
-
Certificates and sign-in
Automated certificates for public websites, private certificate authorities for internal systems, sign-in with passkeys, and single sign-on with an organization's existing accounts.
-
Libraries
Established, reviewed libraries for the underlying primitives.