labs@atheron:~/industries/defence-aerospace/compliance$ audit --controls --evidence

Defence compliance

Controlled goods and secure deployments, scoped with you.

Controlled goods, export rules and customer security requirements shape where defence software runs and who can see its data. We scope that work with your designated official and security team, build to the controls and support your audit; certification and attestation reports are issued by independent auditors.

Start a project See the example projects

// what matters here

What is different in this industry.

Controlled Goods Program scope

Which data and items are controlled, who may access them and what must be logged, set with your designated official. The obligations stay with your registered company.

Deployment your security team approves

On premises, in your tenant or air-gapped, with hardening, patching and update paths agreed before the build.

Independent testing

An independent penetration test before go-live, with findings fixed and retested, and the lead time shown in the estimate.

Evidence for your audits

Access logs, configuration records and test results kept so your audits and customer reviews have what they ask for.

// example projects

Priced examples for this service.

Each one is hypothetical, labelled as such, and priced live from our rate card. Open any of them in the estimator and make it yours.

Example projectWeb app

Controlled goods register

Hypothetical. Not a client, not a result.

// The problem

A registered supplier tracks visitors, staff registrations and access to controlled items and technical data in spreadsheets, and gathering records for an inspection takes a week.

// What we would build

A register on the supplier's own servers for visitor screening records, staff registrations and exemptions, access to controlled items and technical data, and training, with reminders before anything lapses. The obligations stay with your registered company and designated official; we build the records they keep and give no legal advice.

// What is in it

Visitor and staff records with screening and registration status
Access to controlled items and technical data logged by person and time
Training records with reminders before they lapse
Reports for your designated official and for inspections
Servers on premises, in English and French

// Stack

Next.js
PostgreSQL
On-premise servers
Directory sign-in

// estimate

Build: ≈ US$81,100 to US$123,000, delivered within 19 weeksCAD 115,500 to 175,400
Support: ≈ US$2,500 a monthCAD 3,565 a month

Prices in your currency are estimates from today's Bank of Canada rate. All invoicing is in CAD or USD.

Timeline by milestone

Discovery: 2.9 to 3.4 weeks
Design approved: 2.4 to 3.4 weeks
Access rules reviewed with your designated official: 1.4 to 2.4 weeks
Core features: 2.4 to 4.4 weeks
Full build: 1.9 to 2.9 weeks
Testing and fixes: 0.9 weeks
Security review questions answered: 0.9 weeks
Launch: 0.9 to 1.4 weeks

Outside our hands, and added to the calendar

Server delivery and installation: 2 to 6 weeks
Security review and vendor onboarding: 4 to 8 weeks

How it is paid

Deposit 20%: CAD 23,100 to 35,080
Discovery 6%: CAD 6,930 to 10,524
Design approved 6%: CAD 6,930 to 10,524
Access rules reviewed with your designated official 7.7%: CAD 8,893.50 to 13,505.80
Core features 18.1%: CAD 20,905.50 to 31,747.40
Full build 12%: CAD 13,860 to 21,048
Testing and fixes 6%: CAD 6,930 to 10,524
Security review questions answered 7.7%: CAD 8,893.50 to 13,505.80
Launch 6.5%: CAD 7,507.50 to 11,401.00
Holdback, 30 days after launch (10%): CAD 11,550 to 17,540

Start from this example

Example projectWeb appAIOpen-source model

Air-gapped manuals assistant

Hypothetical. Not a client, not a result.

// The problem

Maintainers search thousands of pages of restricted technical manuals by hand, and no outside AI service is allowed near them.

// What we would build

An assistant on an open-source model running on a GPU server inside an air-gapped network, answering from the organisation's own manuals and citing the section, with updates brought in on approved media. Nothing reaches the internet, in either direction.

// What is in it

Manuals and service bulletins indexed inside the air-gapped network
Answers that cite the manual section, for the maintainer to check
Access by role, so each user sees only the manuals they may see
An open-source model on a GPU server with no network path outside
Updates and new manuals loaded through your approved media process

// Stack

Llama or Mistral (open-source)
vLLM
PostgreSQL with pgvector
Next.js
Lenovo GPU server, air-gapped

// estimate

Build: ≈ US$120,000 to US$183,000, delivered within 25 weeksCAD 171,200 to 260,200
Hosting: ≈ US$176 a monthCAD 250 a month
Support: ≈ US$2,500 a monthCAD 3,565 a month
Hardware: ≈ US$47,800 to US$197,000CAD 68,000 to 280,800

Prices in your currency are estimates from today's Bank of Canada rate. All invoicing is in CAD or USD.

AI route: Open-source model
Model running cost: ≈ US$176 a monthCAD 250 a month

Timeline by milestone

Discovery: 2.9 to 3.4 weeks
Specification and evaluation plan: 0.4 weeks
Design approved: 2.4 to 3.4 weeks
Access rules reviewed with your designated official: 1.4 to 2.4 weeks
Core features: 1.4 to 2.4 weeks
Full build: 0.9 to 1.4 weeks
Working pilot: 3.9 to 6.9 weeks
Testing and fixes: 0.4 to 0.9 weeks
Penetration test findings closed: 0.9 to 1.9 weeks
Launch: 0.9 to 1.4 weeks
Production: 0.9 to 1.4 weeks

Outside our hands, and added to the calendar

Hardware delivery, after it is ordered: 2 to 6 weeks
Independent penetration test and retest: 2 to 4 weeks

How it is paid

Deposit 20%: CAD 34,180 to 51,980
Discovery 1.5%: CAD 2,563.50 to 3,898.50
Specification and evaluation plan 8%: CAD 13,672 to 20,792
Design approved 1.5%: CAD 2,563.50 to 3,898.50
Access rules reviewed with your designated official 7.7%: CAD 13,159.30 to 20,012.30
Core features 4.6%: CAD 7,861.40 to 11,955.40
Full build 3.1%: CAD 5,297.90 to 8,056.90
Working pilot 24.2%: CAD 41,357.80 to 62,895.80
Testing and fixes 1.5%: CAD 2,563.50 to 3,898.50
Penetration test findings closed 7.7%: CAD 13,159.30 to 20,012.30
Launch 1.5%: CAD 2,563.50 to 3,898.50
Production 8.7%: CAD 14,868.30 to 22,611.30
Holdback, 30 days after launch (10%): CAD 17,090 to 25,990
GPU time for training and testing, at cost: CAD 300. Billed up front, at cost, outside the milestones
GPU server for AI, for the model: CAD 68,000 to 280,800. Billed up front, at cost, outside the milestones

Start from this example

Example projectWeb appMobile appMaterials tracking

MRO serialised parts tracking

Hypothetical. Not a client, not a result.

// The problem

A maintenance, repair and overhaul shop tracks serialised parts on paper travellers and in its ERP, and assembling a part's full history for a customer audit takes days.

// What we would build

A web system and an Android app on rugged mobile computers that scan each part's barcode or data matrix mark at every step, record inspections, repairs and modifications against its serial number, and hold the full history on servers in the shop, with access to controlled data limited to the people your designated official approves.

// What is in it

Parts scanned by barcode or data matrix at receiving, each work step and release
Inspections, repairs and modifications recorded against the serial number
The full history of a part, built in seconds for a customer or an auditor
Work orders and parts read from the ERP
Servers on premises, with access to controlled data set by role
Rugged scanners, mobile computers and label printers listed by quantity

// Stack

Next.js
Kotlin for Android
PostgreSQL
ERP integration
On-premise servers

// estimate

Build: ≈ US$196,000 to US$299,000, delivered within 42 weeksCAD 278,800 to 425,200
Support: ≈ US$5,010 a monthCAD 7,135 a month
Hardware: ≈ US$50,000 to US$70,400CAD 71,150 to 100,250

Prices in your currency are estimates from today's Bank of Canada rate. All invoicing is in CAD or USD.

Timeline by milestone

Discovery: 2.9 to 3.4 weeks
Discovery and site walk-through: 0.4 weeks
Design approved: 3.9 to 6.4 weeks
Access rules reviewed with your designated official: 3.4 to 5.4 weeks
Core features: 1.9 to 2.9 weeks
Full build: 0.9 to 1.9 weeks
First build on devices: 2.4 to 4.4 weeks
Stock, receiving and transfers: 3.4 to 5.4 weeks
Tracking and devices working: 2.4 to 3.9 weeks
Testing and fixes: 0.4 weeks
Store submission: 0.4 weeks
Pilot site live: 2.9 to 3.4 weeks
Security review questions answered: 2.9 to 3.4 weeks
Launch: 0.9 to 1.4 weeks
Rollout: 0.9 to 1.4 weeks

Outside our hands, and added to the calendar

Hardware delivery, after it is ordered: 2 to 6 weeks
App store review: 1 week
Security review and vendor onboarding: 4 to 8 weeks
ERP test access from your IT team: 1 to 4 weeks

How it is paid

Deposit 20%: CAD 55,760 to 85,040
Discovery 3.5%: CAD 9,758 to 14,882
Discovery and site walk-through 3%: CAD 8,364 to 12,756
Design approved 6.5%: CAD 18,122 to 27,638
Access rules reviewed with your designated official 7.7%: CAD 21,467.60 to 32,740.40
Core features 3.6%: CAD 10,036.80 to 15,307.20
Full build 2.4%: CAD 6,691.20 to 10,204.80
First build on devices 7%: CAD 19,516 to 29,764
Stock, receiving and transfers 9%: CAD 25,092 to 38,268
Tracking and devices working 6%: CAD 16,728 to 25,512
Testing and fixes 1.2%: CAD 3,345.60 to 5,102.40
Store submission 2.3%: CAD 6,412.40 to 9,779.60
Pilot site live 3%: CAD 8,364 to 12,756
Security review questions answered 7.7%: CAD 21,467.60 to 32,740.40
Launch 3.5%: CAD 9,758 to 14,882
Rollout 3.6%: CAD 10,036.80 to 15,307.20
Holdback, 30 days after launch (10%): CAD 27,880 to 42,520
Rack server x 2: CAD 28,500 to 57,600. Billed up front, at cost, outside the milestones
Rugged barcode scanner x 10: CAD 17,600. Billed up front, at cost, outside the milestones
Mobile computer with scanner x 10: CAD 17,600. Billed up front, at cost, outside the milestones
Industrial label printer x 2: CAD 4,760. Billed up front, at cost, outside the milestones
Labels and ribbons, starter stock x 8: CAD 2,400. Billed up front, at cost, outside the milestones
Corded barcode scanner, for our build and testing: CAD 290. Billed up front, at cost, outside the milestones

Start from this example

// questions

Questions we get about this.

Are you registered in the Controlled Goods Program?

We do not claim to be. Your company's registration and your designated official set what we may access; we work within those limits and discuss them at scoping.

Can you build to ISO 27001 or customer requirements?

Yes, we build to the controls and support your audit. Certification is issued by an independent certification body, not by us.

Do you give export control advice?

No. Export and controlled goods questions are for your designated official and your advisers. We build to the scope they set.

Back to the industry: Defence and aerospace About the service: Compliance and security engineering

// next

Not quite your project?

Tell us what you have in mind. We will come back to you with a range and the questions that would narrow it. Or book a call and talk it through.

Start a project Book a call