K109 — full-cycle engineering bureau

Design.Build.Operate.

online · all systems nominal

From architecture and UI/UX to hardened operations — and AI that never leaves your perimeter.

Start a projectExplore capabilities
11
engineering domains
70+
tools in the stack
100%
of AI runs on-prem

Services

Six service lines — from product development to AI engineering.

01Product Development· Web, mobile and desktop from one team

We build products across the whole surface: React or Angular SPAs, Astro and Next.js sites, NestJS services, React Native apps, Electron desktops. One team, one responsibility — from first mockup to production.

What we deliver

  • MVPs and full product cycles
  • Web, iOS, Android and desktop builds
  • Design-to-production without hand-off gaps
  • Legacy frontend rescue and migration
    • ReactAngularAstroNext.jsNestJSPrismaReact NativeElectron
    02Platform & DevOps· Infrastructure as code, delivery on rails

    Infrastructure described in Terraform/OpenTofu, configured with Ansible, delivered through GitOps pipelines on Kubernetes and Argo CD. Observability is built in from day one: Prometheus, Grafana, Loki, Jaeger.

    What we deliver

  • IaC audits and greenfield platforms
  • GitOps CI/CD pipelines
  • Kubernetes, service mesh, API gateways
  • Observability stacks people actually read
    • TerraformOpenTofuAnsibleKubernetesArgo CDIstioPrometheusVault
    03Quality Engineering· Quality is automated, not promised

    The full test pyramid in CI: unit and integration with Vitest and Testing Library, E2E with Playwright and Cypress, load with k6, accessibility with axe-core. Every merge passes the gates your users depend on.

    What we deliver

  • Test pyramids built into CI/CD
  • Load and stress testing before launch
  • Accessibility audits (WCAG 2.2)
  • Flaky-test eradication programs
    • VitestPlaywrightCypressk6MSWStorybookaxe-core
    04Security Engineering· Hardened identity, network and data

    SAST/DAST and OWASP ZAP scans in pipelines, SSO on Keycloak and LDAP directories, hardened network design and backup schemes with Bareos — verified by real restores, not by hope.

    What we deliver

  • SAST/DAST and pen-testing in the SDLC
  • SSO/IdM: Keycloak, LDAP, FreeIPA
  • Backups verified by restores
  • Network hardening and scanning
    • KeycloakOWASP ZAPNessusBareosVault
    05Architecture & Design· Decisions drawn before they are built

    C4 maps for every system level, an honest choice between monolith and microservices, domain-driven design backed by patterns — and UI/UX in open-source Penpot, readable even by AI agents.

    What we deliver

  • C4 architecture models
  • Monolith ↔ microservices transitions
  • DDD, CQRS and event-driven design
  • UI/UX design in Penpot
    • C4 modelDDDCQRSSagaPenpot
    06AI Engineering· AI that never leaves your perimeter

    Local inference on llama.cpp and vLLM, RAG over your documents on Qdrant, agent-assisted delivery with Cline and OpenCode, automation with n8n and Flowise. No third-party APIs, no data leaving.

    What we deliver

  • On-prem LLM inference clusters
  • Private RAG over corporate knowledge
  • Agentic workflows for engineering teams
  • n8n/Flowise automation pipelines
    • llama.cppvLLMQdrantn8nFlowiseCline

    Capability matrix

    70+ tools across QA, DevOps, development, security and operations.

    Engineering approach

    Architecture first: C4, domain patterns, shift-left quality, CI/CD automation.

    1Model before code

    Every engagement starts with a map, not a framework. We model the system at four C4 levels so business, architects and developers argue about the same picture.

    1. L1ContextSystem, users, neighbours, dependencies
    2. L2ContainersDeployable units: apps, services, storages
    3. L3ComponentsResponsibilities and APIs inside each container
    4. L4CodeGenerated from code, only when it earns its keep

    2The right shape

    Architecture by fitness, not fashion. Most systems should start as modular monoliths; distribution is a cost we pay only when it earns its keep.

    MonolithDefault start — one deploy, simple debugging, fast time-to-market
    MicroservicesWhen teams or scaling demand independent delivery
    MicrofrontendWhen several teams own one interface

    3Patterns as vocabulary

    Patterns compress decisions. Classic design keeps code changeable; distributed patterns keep systems honest under failure.

    Design

    SOLIDGoFGRASPDDD

    Distributed systems

    SagaCQRSOutboxInboxMessage BrokerCDCCircuit Breaker

    4Shift-left quality

    Defects get cheaper the earlier they die. Quality gates stand at every step of the path, and every gate runs automatically.

    Commitlefthook · eslint · prettier · stylelint
    Merge requestvitest · jest · testing library · msw
    Pre-deployplaywright · cypress · storybook
    Release gatek6 · axe-core · SAST · DAST · OWASP ZAP

    5One pipeline for every change

    Every change walks the same path. Code that was not deployed by the pipeline was never really tested at all.

    COMMITBUILDTESTSCANDEPLOYOBSERVE

    AI Lab

    Local LLM serving, RAG on Qdrant, agent automation — data never leaves your perimeter.

    AI pipeline fully inside the corporate perimeter; external egress is blocked.YOUR PERIMETERDOCUMENTSVECTORS · QDRANTINFERENCEllama.cpp · vLLMAGENTSEGRESS BLOCKEDPUBLIC CLOUD
    1. models: local
    2. weights: yours
    3. egress: 0 bytes

    Local inference

    Production LLM serving on your hardware: llama.cpp for CPU and mixed fleets, vLLM for high-throughput GPU nodes. Quantized, monitored, versioned.

    • llama.cpp
    • vLLM

    Private RAG

    Your documents, embedded and stored in Qdrant inside the perimeter. Answers come with sources — corporate knowledge without corporate leaks.

    • Qdrant
    • RAG

    Agentic automation

    Coding agents Cline, KiloCode and OpenCode for delivery teams; n8n and Flowise pipelines for the rest of the company. Humans approve, agents grind.

    • Cline
    • KiloCode
    • OpenCode
    • DeepSeek harness
    • n8n
    • Flowise

    Security & reliability

    SAST/DAST, penetration testing, SSO, backups, hardened networks.

    • identityfederated
    • codescanned
    • networkhardened
    • datarestorable
    • systemswatched
    IDN

    Identity & access

    Central user directoryldap
    Identity policy, centralizedfreeipa
    Single sign-on (OIDC / SAML)keycloak
    AD-compatible domain servicessamba
    COD

    Code & pipeline

    Static vulnerability analysissast · ci/cd
    Runtime attack simulationdast
    Automated penetration scansowasp zap
    Manual offensive testingpentest · quarterly
    Quality & security gatessonarqube
    NET

    Network

    Perimeter filtering, versionediptables
    Scheduled vulnerability scanningnessus
    Networks simulated before changegns3
    DAT

    Data & recovery

    Backups verified by real restoresbareos · restore drills
    Hardware redundancyhardware raid
    Failover clusteringclustering
    OBS

    Observability & secrets

    Infrastructure monitoringzabbix
    Secrets never live in codehashicorp vault

    Operating principles

    1. Every control has an owner
    2. Restores are rehearsed, not assumed
    3. Access is reviewed, then re-reviewed
    Security questionnaire? Request the attestation pack

    Delivery & support

    Transparent delivery: Redmine, Zulip, BBB, RustDesk, Asterisk, mailcow.

    Delivery tooling runs on our own servers — your project data never touches third-party SaaS.

    Redmine · tasks & plans with historyZulip · threaded team chatBigBlueButton · our own video callsRustDesk · remote support, self-hostedAsterisk · telephony we controlMailcow · mail server, managed

    Plan

    redmine

    Every task, deadline and decision is visible to the client.

    Talk

    zulip · bigbluebutton

    Decisions live in threads; meetings are recorded and minuted.

    Support

    rustdesk · asterisk

    Hands-on help: screen sharing, voice, on-site visits.

    Inform

    mailcow

    Reports and notices come from our own mail, on our domain.

    About K109

    An engineering bureau: full cycle, deep ownership, no hand-offs.

    K109 reads like a design bureau designation. That is the idea.

    We are a full-cycle engineering bureau: architecture, code, platform, quality, security, operations — one team owns the outcome end to end. Drawings before code, tests before release, restores before trust. Boring technology, sharp engineering, and AI that stays inside your perimeter.

    • Full cycle or nothing — no hand-offs over the wall
    • Boring technology, sharp engineering
    • Automate everything that can be automated
    • Knowledge stays: docs, runbooks, handover
    • Local first: data and AI inside the perimeter

    Contact

    Tell us about your system — we answer within one business day.

    Direct channels

    We answer within one business day.