What we operate
- Dedicated Azure hosting and deployment
- Monitoring, health checks and alerting
- Backups and restore
- Security updates and operational security
- Application support and incident management
- Platform maintenance and technical refresh
The cloud foundation
Dedicated Microsoft Cloud
Every solution runs in its own Azure subscription and follows one approved technology stack. One solution equals one dedicated subscription.
The architecture
Five layers, one standard
-
Users and identity
Customer users sign in with their own Microsoft Entra accounts, with least-privilege access.
-
Application experience
React and TypeScript, delivered as a responsive browser application.
-
Business services
C# and .NET on Azure App Service, with APIs and background processing.
-
Data and integration
Azure SQL when required, storage, Microsoft Graph, Microsoft 365 and customer systems.
-
Operations and delivery
Azure DevOps, Bicep, Key Vault, Application Insights, Azure Monitor, backup and CI/CD.
Local, Development, Test/UAT and Production all follow the same Factory baseline.
Isolation
One solution, one Azure subscription
The subscription is the primary administrative, cost and security boundary for a solution. Application resources and customer data are not shared with other solutions.
- Clean cost attribution, because consumption is attributable to the individual solution
- Strong access boundaries, because permissions stop at the subscription edge
- Straightforward troubleshooting, with no noisy-neighbour ambiguity
- A clear handover boundary for organisations where departments operate independently
Data residency
Your data stays in your country
If you are in Australia, your solution runs in an Australian Azure region and your data stays in Australia. Residency is never a default: the region is chosen at project creation from the approved hosting regions, according to the requirements that apply to you.
- One dedicated Azure subscription per solution — an unambiguous boundary
- The region is fixed at project creation and documented with the solution
- Application data and customer data stay in that region
- Your users authenticate with their own Microsoft Entra accounts, so identities are never transferred to us
For customers in Australia, Pack of 7 Pty Ltd is the contracting party. The solution runs in our own Microsoft tenant in an Australian Azure region, and application and customer data stay in Australia — accessed only from within Australia. The same principle applies in other jurisdictions: customers in Germany contract with Pack of 7 GmbH and run in a German Azure region, with no access from outside the European Union.
This is the first question a procurement or security review asks — and here it has a documented answer rather than an assurance.
The approved stack
Intentionally opinionated
The same base technology is used for every supported solution, and it changes centrally for all future projects rather than per engagement.
| Layer | Standard | Factory rule |
|---|---|---|
| Frontend | React + TypeScript | Browser-based user interface. |
| Backend | C# / .NET | Standard API and service layer. |
| Hosting | Azure App Service | Architecture stays portable so container hosting can follow. |
| Relational data | Azure SQL Database | Provisioned when the solution needs a relational database. |
| Identity | Microsoft Entra ID | Users authenticate with accounts from their own organisation. |
| Infrastructure as code | Bicep | Azure resources are created and changed through Factory-controlled IaC. |
| DevOps | Azure DevOps | One project per solution, with standard branch and release structure. |
| Environments | Local, Development, Test/UAT, Production | Separated by environment-specific resource groups and configuration. |
| Secrets | Azure Key Vault | Secrets are not stored in code or ordinary configuration files. |
| Observability | Application Insights + Azure Monitor | Logging, telemetry, health checks and alerting from the first deployment. |
Identity and tenant integration
Your users, your tenant, explicit consent
Applications run in our Azure subscriptions, but your users authenticate with their own Microsoft Entra accounts. They do not need separate accounts from us to use the application.
A solution can also reach Microsoft resources in your tenant when the business process requires it. We automate our side of the integration and generate the onboarding and consent instructions; your administrator performs the tenant consent as a controlled onboarding step.
Automate the provider configuration; make customer consent explicit, least-privilege and auditable.
Operate and evolve
Managed application service
You receive a running business capability — not a codebase you have to operate yourself.
What you own and control
- Business priorities and the roadmap
- Your customer data
- The customer-specific solution IP
- Users and access decisions
- Acceptance and process decisions
Managed operation without surrendering control of the customer-specific solution and data.
Commercial model
Built around application outcomes, not developer hours
Three components combine.
01
Application creation
Discovery, solution design, Factory project creation, implementation, testing, deployment preparation, acceptance and production launch. Fixed-price or milestone-based structures are preferred where scope is sufficiently defined.
02
Managed application service
Hosting, monitoring, backups, restore, operational security, incident management, application support and platform maintenance. Dedicated Azure consumption is attributable to the individual solution.
03
Continuous evolution
Recurring enhancement capacity after go-live. New features, integration changes, AI improvements, UX changes and technical refresh run through the same Factory process.
Portability and ownership
Designed so you are never trapped
Enhancements use the same Factory process that built the application. The architecture is independently deployable: configuration is externalised, state lives in defined services, and infrastructure is described as code.
That is deliberate. It means a solution can be handed over along a defined path — the customer-specific source code, a data export, a deployable infrastructure definition, configuration and operating documentation — without transferring the Factory itself. Reusable Factory intellectual property remains ours; your customer-specific application assets and your data remain yours.