Cloud infrastructure on Google Cloud.

• Cloud Run architecture

  Cloud Run services and jobs, Cloud Functions, Cloud Tasks, and Cloud Scheduler: private, IAM-only workers called with OIDC tokens, and queues paced to their consumer (Cloud Tasks, chosen over Pub/Sub in an architecture decision record).

• Databases and data

  Cloud SQL Postgres behind a PgBouncer VM on a private VPC, IAM-authenticated database access through proxy sidecars, and BigQuery for the warehouse.

• Security and least privilege

  Least-privilege IAM bindings, keyless access, Secret Manager with key rotation without redeploys, consoles behind Identity-Aware Proxy, and an insert-only database role for a public webhook.

• CI/CD

  Cloud Build pipelines for every deployable service, database migrations that run before each deploy so a failing one stops the release, and promotion from dev to staging to production.

• Infrastructure as code

  Workloads integrated into the staging environment of Bulq.ai's OpenTofu-managed platform, to its keyless, least-privilege standard, and an infrastructure map kept in step with the code by a CI drift check.

• One project per client

  DataSync runs each client's syncs as Cloud Run jobs in the client's own GCP project, so compute is isolated and billed to the client, from one container image rolled out to every project.

• Monitoring

  Cloud Monitoring alert policies, in-app alerts, live run logs, and OIDC-secured scheduled jobs managed from the app.

1. 01

   Design it with the product

   System architecture and interface, designed together so the product holds up in production.

2. 02

   Every deploy through a pipeline

   At Purely White Deluxe, one Cloud Build pipeline provisions and deploys three Cloud Run services per app, and builds separate sandbox and production apps from the same code.

3. 03

   Your project, your bill

   Workloads can run in your own Google Cloud project: Purely White Deluxe's integration is built that way, and DataSync runs each client's syncs in the client's project.

4. 04

   Run it

   We deploy on GCP, AWS, or Vercel, then monitor and evolve what we ship.

Cloud Run, Cloud Functions, Cloud Tasks, and Cloud Scheduler; Cloud SQL and BigQuery; IAM, Secret Manager, and Identity-Aware Proxy; Cloud Build, Artifact Registry, and Cloud Monitoring; OpenTofu and GitHub Actions; nginx where a site needs it.

• Cloud Run
• Cloud SQL
• BigQuery
• Cloud Tasks
• Cloud Scheduler
• IAM
• Secret Manager
• Identity-Aware Proxy
• Cloud Build
• Cloud Monitoring
• OpenTofu
• nginx

• Do you work as a Google Cloud consultant on existing projects?

  Yes. On Bulq.ai's platform, we integrated our workloads into the staging environment of the client's OpenTofu-managed Google Cloud, to its own keyless, least-privilege standard.

• Why Cloud Run?

  Cloud Run runs containers as services or jobs with no servers to manage, kept private behind IAM when they should be. FundReachr, Bonjout Beauty's MRP, DataSync, and this website run on it.

• Can it run in our own Google Cloud project?

  Yes. Purely White Deluxe's integration is built in the brand's own Google Cloud, and DataSync runs each client's syncs in the client's own GCP project, isolated and billed to the client.

• How do you keep secrets and access safe?

  Least-privilege IAM, keyless access where the platform allows it, secrets in Secret Manager rotated without redeploys, OIDC tokens on scheduled and queued calls, and private services reachable only through IAM or Identity-Aware Proxy.

• How do deploys work?

  Through Cloud Build: every deployable service has its own pipeline, database migrations run before the API deploys so a failing one stops the release, and changes move from dev to staging to production.

• Do you only work on Google Cloud?

  Our case studies are built on Google Cloud, and we also deploy on AWS or Vercel when a product calls for it.